CSP Header Generator API

Build a Content-Security-Policy from directive lines (as header, meta tag, Nginx and Apache config) with a security analysis, or analyse an existing policy for risky settings.

POST /api/v1/tools/csp-header-generatorMCP csp_header_generatorSecurity & Privacy

Build a Content-Security-Policy header from presets and directives, with nonces and hashes, then copy it for Nginx, Apache or a meta tag, or analyse a policy.

Input

Send these as a JSON object. Unknown fields are rejected.

mode: build: assemble a policy from `directives`. analyse: break down and grade an existing `policy`. (string, one of build, analyse, default "build")
directives: build mode: one directive per line, name then space-separated sources, e.g. "script-src 'self' https://cdn.example.com". Supported: default-src, script-src, style-src, img-src, connect-src, font-src, frame-src, media-src, worker-src, manifest-src, object-src, base-uri, form-action, frame-ancestors. Keywords need their quotes ('self', 'none', 'unsafe-inline', 'nonce-…', 'sha256-…'). (string, up to 20000 characters)
upgradeInsecureRequests: build mode: add upgrade-insecure-requests. (boolean, default false)
reportUri: build mode: report-uri value, an https:// URL or a path starting with /. (string, up to 2048 characters)
reportTo: build mode: report-to endpoint name defined in a Reporting-Endpoints header. (string, up to 100 characters)
reportOnly: build mode: output Content-Security-Policy-Report-Only instead of an enforcing policy. (boolean, default false)
policy: analyse mode: the policy, with or without a 'Content-Security-Policy:' prefix, or a <meta> tag. (string, up to 20000 characters)

Try it in the browser JSON Schema Get an API key

curl https://pithlab.com/api/v1/tools/csp-header-generator \n  -H "Authorization: Bearer $PITHLAB_KEY" \n  -H "Content-Type: application/json" \n  -d '{"mode":"build","directives":"default-src '''self'''\nscript-src '''self''' https://cdn.example.com\nobject-src '''none'''\nframe-ancestors '''none'''","upgradeInsecureRequests":true}'

Example response

{
  "ok": true,
  "result": {
    "policy": "default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests",
    "header": "Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests",
    "meta": "<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; upgrade-insecure-requests\">",
    "metaDropped": [
      "frame-ancestors"
    ],
    "nginx": "add_header Content-Security-Policy \"default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests\" always;",
    "apache": "Header always set Content-Security-Policy \"default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests\"",
    "errors": [],
    "findings": [
      {
        "severity": "medium",
        "directive": "base-uri",
        "message": "base-uri is missing and does not fall back to default-src. An injected <base> tag could redirect relative script URLs. Set base-uri 'self' or 'none'."
      },
      {
        "severity": "low",
        "directive": "form-action",
        "message": "form-action is missing and does not fall back to default-src, so injected forms can post anywhere. Set form-action 'self'."
      }
    ]
  }
}