CSP strict-dynamic
Allows trust from a nonce- or hash-authorised script to propagate to scripts it loads.
Support in current browsers
Checked against the current browser versions recorded in MDN browser data 8.0.7.
| Browser | Minimum | Outcome | Reason |
|---|---|---|---|
| Chrome | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Edge | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox | 152 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Chrome for Android | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox for Android | 152 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari on iOS | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Android WebView | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Samsung Internet | 29.0 | Works | Every required mapped BCD feature is available without a recorded qualification. |
What this feature can and cannot do
Helps protect against
- Brittle host allowlists
- Script injection through allowed origins
Does not guarantee
- Compromise of an authorised script
- Unsafe script loaders
- Browsers that ignore the source expression
What you need before using it
- CSP nonces or hashes
- A tested fallback source list
Fallback to keep in place
Retain compatible host and scheme sources for browsers that do not implement strict-dynamic.