CSP evaluator
Check a Content-Security-Policy header for unsafe-inline/eval, wildcard sources, and missing default-src, object-src, or base-uri, on your device.
CSP evaluator parses a Content-Security-Policy header into its directives, flagging issues Google's own CSP Evaluator tool popularized. A missing default-src draws attention first, alongside object-src or base-uri left unset. Unsafe-inline or unsafe-eval sources, plus a bare wildcard or plain http: origin, get flagged too. Findings are HIGH, MEDIUM, LOW or OK, sorted worst first. An empty policy is refused first.
Questions
What issues does it check?
unsafe-inline without a nonce or hash, unsafe-eval, wildcard sources, plain http: sources, and missing default-src, object-src or base-uri.
What severities does it use?
HIGH, MEDIUM, LOW and OK, sorted with the most serious findings first.
What if the policy has no directives at all?
The tool refuses with a message describing the expected directive-name source-list format.
Is this a copy of Google's CSP Evaluator code?
No, it is an independent pass over the parsed directives modelled on the same checks that tool popularized, not a port of its code.
What counts as OK for object-src?
Only object-src 'none' exactly; anything else is flagged MEDIUM for still allowing legacy plugin content.