Cybersecurity glossary
What is a CSP Hash?
Learn what a CSP hash is, how sha256 hashes in script-src allow specific inline scripts, when hashes beat nonces, and how to keep hash-based CSP maintainable.
Definition
A CSP hash is a cryptographic digest of an inline script or style block listed in a Content-Security-Policy source list (for example 'sha256-...') so the browser allows that exact inline content without permitting arbitrary unsafe-inline execution.
Why CSP hashes matter
Strict CSP wants to eliminate 'unsafe-inline' for scripts. Some pages still need a tiny inline bootstrapper—theme init, config JSON slot, or framework hydration stub. A CSP hash allowlists that exact byte sequence without opening the door to arbitrary injected inline script.
Hashes are especially attractive for static or infrequently changing inline snippets where per-request nonces add operational cost.
How hash allowlisting works
Identify trusted inline content
Select the exact script or style block text that must remain inline.
Compute the digest
Hash the exact content (commonly SHA-256) and base64-encode it for CSP.
List it in CSP
Add 'sha256-...' to script-src or style-src.
Browser verifies on execute
Inline blocks run only if their content matches a listed hash (or other allowed source).
Update hashes when content changes
Redeploy policy whenever the inline snippet changes.
Hash vs nonce in practice
| Dimension | Hash | Nonce |
|---|---|---|
| Dynamic HTML | Awkward if inline content changes often | Natural fit per response |
| Static snippets | Excellent | Works but needs generation plumbing |
| Caching HTML | Easier for fully static pages | Dangerous with shared public caches |
| Build integration | Compute at build time | Generate at request time |
Pitfalls to avoid
Whitespace sensitivity
Minifiers or template formatting can silently invalidate hashes.
Hash sprawl
Dozens of inline blocks make policy brittle—prefer external files.
unsafe-inline still present
A leftover unsafe-inline can defeat the purpose of hash allowlisting.
Confusing SRI with CSP hashes
SRI protects external file integrity; CSP hashes gate inline execution.
Implementation checklist
- Inventory every inline script/style that must remain in HTML.
- Automate sha256/384/512 computation from the exact emitted content.
- Remove script-src 'unsafe-inline' after hashes or nonces cover needs.
- Prefer moving large inline scripts to external files with SRI.
- Fail CI when inline content changes without CSP header updates.
- Use Report-Only while introducing hash policies.
- Document which templates own which hashed snippets.
- Consider nonces instead if inline content is highly dynamic.
The practical takeaway
A CSP hash allowlists exact inline script or style content under Content Security Policy using digests such as 'sha256-...'. It enables strict CSP without 'unsafe-inline' for stable snippets.
Automate hash generation, keep inline surface tiny, and treat any content change as a policy change—or switch to nonces when inline HTML is dynamic.
Related security terms
CSP Nonce
Per-response alternative for allowlisting trusted inline scripts.
Content Security Policy (CSP)
Parent header mechanism that consumes hash sources.
Subresource Integrity (SRI)
Related hashing concept for external script files rather than inline blocks.
CSP strict-dynamic
Often combined with a nonce or hash bootstrap script.
Frequently asked questions
What is a CSP hash in simple terms?
It is a fingerprint of an inline script. CSP lists that fingerprint so only an inline block with exactly that content may run.
Which algorithms are used?
Browsers commonly support sha256, sha384, and sha512 hashes in CSP source lists.
When should I prefer hashes over nonces?
Hashes work well for small, stable inline scripts—especially on mostly static pages—without generating per-response values. Nonces fit dynamic HTML better.
What breaks a CSP hash?
Any change to the inline content, including whitespace or comments, changes the digest and causes the script to be blocked until the policy is updated.
Can I hash external .js files in script-src?
CSP hashes apply to inline script/style content. External files are controlled via hosts, nonces on script tags in some models, strict-dynamic, or Subresource Integrity separately.
Do hashes help if I still have unsafe-inline?
Keeping unsafe-inline typically undermines the XSS value of hash allowlisting. Remove unsafe-inline once hashes or nonces cover legitimate needs.
How do build pipelines handle CSP hashes?
Compute digests at build or deploy time from the exact inline snippets emitted into HTML, then inject them into the CSP header.
References
Explore authoritative guidance and frameworks related to csp hash.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.