CSP Builder

CSP Builder

Build Content Security Policy headers from presets or config files. Test policies against live URLs and generate violation report configurations. Stop XSS before it starts.

Features

• Directive generator — covers all standard CSP directives (default-src, script-src, style-src, etc.)
• Preset policies — strict, moderate, and permissive presets for quick starts
• Policy tester — validate a URL's existing CSP headers and identify gaps
• Violation reporting — configure report-uri and report-to directives
• Nonce generation — create cryptographic nonces for inline scripts and styles
• Multiple output formats — HTTP header string or HTML tag
• Config file support — version-control your CSP policies as JSON
• Directive reference — built-in documentation for every CSP directive

Requirements

• Python 3.10+
• No external dependencies (stdlib only)

Quick Start

# Generate a strict CSP header
python src/csp_builder.py --preset strict

# Build from a config file
python src/csp_builder.py --config examples/csp_config.json --output csp_header.txt

# Test a live URL's CSP
python src/csp_builder.py --test --url https://example.com

Output

Outputs a ready-to-use CSP header string (e.g., Content-Security-Policy: default-src 'none'; script-src 'self'; ...) or an HTML meta tag equivalent. Test mode shows the existing policy with gap analysis.

Configuration Reference

Define your policy in JSON (see examples/csp_config.json):

{
    "directives": {
        "default-src": ["'none'"],
        "script-src": ["'self'", "https://cdn.example.com"],
        "style-src": ["'self'", "'unsafe-inline'"],
        "img-src": ["'self'", "data:"],
        "connect-src": ["'self'", "https://api.example.com"],
        "font-src": ["'self'"],
        "frame-ancestors": ["'none'"]
    },
    "report_uri": "https://report.example.com/csp"
}

... continues with setup instructions, usage examples, and more.