header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'");
<script>console.log("Hello world");</script>

However I still receive in Chrome:

Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'sha256-1DCfk1NYWuHM8DgTqlkOta97gzK+oBDDv4s7woGaPIY='". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.

I've toyed with this for over an hour but still am unable to generate a hash that matches examples eg.

http://software-security.sans.org/downloads/appsec-2014-files/building-a-content-security-policy-csp-eric-johnson.pdf Claims <script>alert('Allowed to execute');</script> (hard to determine original spacing) has hash of sha256-MmM3YjgyNzI5MDc5NTA0ZTdiCWViZGExZDkxMDhlZWIw NDIwNzU2YWE5N2E4YWRjNWQ0ZmEyMDUyYjVkNjE0NTk=

Which doesn't make much sense: the last part doesn't start with sha256-, but at least the first hash is the correct length. I get sha256-nbFv/38jW7zf8mQirwFemFjDwp5CwIaorxe4Z3yycn0= as the hash for alert('Allowed to execute');

http://nmatatal.blogspot.com/2013/09/how-my-script-hash-poc-works.html Claims: <script>console.log("Hello world");</script> should have a csp of script-src 'sha256-y/mJvKQC/3H1UwsYAtTR7Q==' eyeballing it, that looks too short.

What am I doing wrong?

  • Hey, wanted to follow up on the link referenced. sha256 isn't supported, just sha1. I think the value would be fU8Y3i83rje0823mI+3hgmqgysc= but I haven't tested. Updated the docs accordingly and that link now points to a blog using script hash. – oreoshake Aug 23 '14 at 21:20

UPDATE: it seems script hashes are not supported in the Chrome release version. My test only works in Chrome Canary (when using script-src, not default-src)


You should try using "script-src" instead of "default-src" (based on my quick reading of the working draft)

  • This is the test page that works in Chrome Canary: pastebin.com/2pnT728f – Joel L May 27 '14 at 12:38
  • I actually switched from script-src to default-src because it wasn't working for me. Your update makes sense why neither was working for me. – Steven R. May 28 '14 at 10:40
  • I read the draft but wasn't sure how to treat proceeding and trailing whitespace in <script> tags. I'll do some test and see if I can find out what Chrome Canary does. – Steven R. May 28 '14 at 10:42

This is still incredibly confusing. I'm running Chrome 40 and like you I've just spent far longer than I would have liked figuring out what's going on.

The CSP 2 spec says this about hashing <script> elements:

For example, the SHA-256 digest of alert('Hello, world.'); is YWIzOWNiNzJjNDRlYzc4MTgwMDhmZDlkOWI0NTAyMjgyY2MyMWJlMWUyNjc1ODJlYWJhNjU5MGU4NmZmNGU3OAo=.

I've managed to generate that hash by running:

$ echo -n "alert('Hello, world.');" | openssl dgst -sha256 | base64

But this does not work in Chrome 40.

The editor's draft of CSP says this:

For example, the SHA-256 digest of alert('Hello, world.'); is qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=.

The example they give is generated with:

$ echo -n "alert('Hello, world.');" | openssl dgst -sha256 -binary | base64

The addition of the -binary flag to openssl is the difference between the two commands.

This does work in Chrome 40 (stable) and Chrome Canary, but I believe it still has issues in Firefox 36.


For those interested, here is how you can calculate the CSP script hash in Java-8

public String calcCSPScriptHash(String scriptCode) throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    return "sha256-" + Base64.getEncoder().encodeToString(md.digest());


So it looks that all you have to do (for the time being, until Chrome updates to reflect the status change of the CSP 1.1 proposal) is, to change the header name back to X-Content-Security-Policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.