Test your settings using **Report Only** before applying them in **Enforced**.
**Enforced** will stop scripts that violate the rules from executing, so test first.
You can also enable the **Content Security Policy Extras** module to harden the security of Drupal core's AJAX.
## How to specify a hash for a script
If you are not using `unsafe-inline`, then you can add hashes for your scripts to CSP.
This is supported but NOT RECOMMENDED because Drupal core currently requires `unsafe-inline` for important features (like CKEditor).
If you still want to use hashes, you can specify a hash in the following format: '{hashAlgorithm}-{base64-value}'
- The wrapping single quotes are required.
- The valid hashing algorithms are sha256, sha384, or sha512.
- The hash value must be base64 encoded.
- All characters within the script (or style) element, including leading and trailing whitespace, must be used to calculate the hash value.
If your browser provides a hash value in its CSP error message in the console, you should be able to copy that value. Report-URI.com also provides a tool to generate hashes for arbitrary values: https://report-uri.com/home/hash
## Features
- Integrates with Drupal's Libraries API to automatically generate a default
site-wide policy for JavaScript and CSS
- Up-to-date with the latest
[CSP Level 3 Working Draft](https://www.w3.org/TR/CSP/)
- Policy is automatically optimized to remove duplicate directives and reduce
header length
- Dispatches an event to allow other modules to alter policies for each request