Read CSP

Request Host

The request host is app.example.

highlighted = computed this step

The request asks for one page

The request line points to the pinned page path.

GET /page\text{GET /page}
Request hostThe request host, CSP policy directives, script decisions, empty body, and checks are recomputed from pinned bytes.Request host - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

The Host row names app.example

The self policy is read relative to this toy app host.

Host=app.example\text{Host}=\text{app.example}
Request hostThe request host, CSP policy directives, script decisions, empty body, and checks are recomputed from pinned bytes.Request host - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

The request body is empty

The blank line ends the headers in this pinned GET request.

request rows checked\text{request rows checked}
Request hostThe request host, CSP policy directives, script decisions, empty body, and checks are recomputed from pinned bytes.Request host - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

Summary

The CSP policy will be attached to the exact host and page response.

request checked\text{request checked}
Request hostThe request host, CSP policy directives, script decisions, empty body, and checks are recomputed from pinned bytes.Request host - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty