CSP Hash Generator
When I need a CSP Hash?
If you are already implemented the Content-Security-Policy header and want to use inline scripts and/or styles but don't want to use the 'unsafe-inline' directive. Then probably you will see a similar error in DevTools console.
What's a CSP Hash?
It's a string composed of two parts connected by a dash with each other - the cryptographic algorithm used to create the hash value (message digest) and base64-encoded hash of a script or style.
How to generate a CSP Hash?
To generate a CSP hash with PHP use the following code snippet:
<?php
$algo = 'sha256';
$data = "console.log('Hello World');"; # This is your inline JS/CSS without the <script>/<style> tags
$data = preg_replace('/\r\n/', '\n', $data);
$base64 = base64_encode(hash($algo, $data, true));
echo "$algo-$base64";
# sha256-4saCEHt0PuLiuYPF+oVKJcY5vrrl+WqXYIoq3HAH4vg=
?>
Where to use CSP hashes?
Append this hash to the script-src or style-src
directives of your Content-Security-Policy header. This is how to send
an HTTP response header:
- CSP header with Apache:
Header set Content-Security-Policy "script-src 'sha256-4saCEHt0PuLiuYPF+oVKJcY5vrrl+WqXYIoq3HAH4vg='"
- CSP header with PHP:
<?php
header("Content-Security-Policy: script-src 'sha256-4saCEHt0PuLiuYPF+oVKJcY5vrrl+WqXYIoq3HAH4vg='");
?>
Social share
Share this tool with friends and colleagues on your favorite social network: