The toy CSP example keeps its boundary narrow.
What this toy model checks
The trust boundary parses one GET request, one response with Content-Security-Policy, two self directives, two script decision rows, and one empty body.
recompute CSP rows \text{recompute CSP rows} recompute CSP rows CSP honesty boundary The script decisions and empty response body are recomputed from the pinned CSP response. CSP honesty boundary - app.example allows self scripts and blocks inline script section name value check request line method GET parsed request line path /page parsed request line version HTTP/1.1 parsed header Host app.example exact header Content-Security-Policy default-src 'self'; script-src 'self' exact directive default-src self self directive script-src self self script decision /app.js allowed same origin script decision inline script blocked not self status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host app.example exact check status 200 OK ok check default-src self self check script-src self self check same-origin script allowed allowed check inline script blocked blocked check sent body bytes 0 empty
Honesty boundary
NOTE: toy HTTP CSP header only; not a browser engine, full CSP grammar, nonces, hashes, reports, style rules, images, frames, workers, mixed content, XSS defense completeness, redirects, HTTP/2 or HTTP/3, frameworks, or production security config.
toy CSP header only \text{toy CSP header only} toy CSP header only CSP honesty boundary The script decisions and empty response body are recomputed from the pinned CSP response. CSP honesty boundary - app.example allows self scripts and blocks inline script section name value check request line method GET parsed request line path /page parsed request line version HTTP/1.1 parsed header Host app.example exact header Content-Security-Policy default-src 'self'; script-src 'self' exact directive default-src self self directive script-src self self script decision /app.js allowed same origin script decision inline script blocked not self status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host app.example exact check status 200 OK ok check default-src self self check script-src self self check same-origin script allowed allowed check inline script blocked blocked check sent body bytes 0 empty
No client compute
The page shows already validated rows. It does not evaluate CSP in browser code.
static validated rows \text{static validated rows} static validated rows CSP honesty boundary The script decisions and empty response body are recomputed from the pinned CSP response. CSP honesty boundary - app.example allows self scripts and blocks inline script section name value check request line method GET parsed request line path /page parsed request line version HTTP/1.1 parsed header Host app.example exact header Content-Security-Policy default-src 'self'; script-src 'self' exact directive default-src self self directive script-src self self script decision /app.js allowed same origin script decision inline script blocked not self status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host app.example exact check status 200 OK ok check default-src self self check script-src self self check same-origin script allowed allowed check inline script blocked blocked check sent body bytes 0 empty
Summary
CSP can describe which sources are allowed, but this page only models one tiny self-only policy.
CSP boundary checked \text{CSP boundary checked} CSP boundary checked CSP honesty boundary The script decisions and empty response body are recomputed from the pinned CSP response. CSP honesty boundary - app.example allows self scripts and blocks inline script section name value check request line method GET parsed request line path /page parsed request line version HTTP/1.1 parsed header Host app.example exact header Content-Security-Policy default-src 'self'; script-src 'self' exact directive default-src self self directive script-src self self script decision /app.js allowed same origin script decision inline script blocked not self status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host app.example exact check status 200 OK ok check default-src self self check script-src self self check same-origin script allowed allowed check inline script blocked blocked check sent body bytes 0 empty