lement has no `
nonce ` attribute, there is no way to associate it with this CSP source).

` '<hash-algorithm>-<base64-value>' `

    

A sha256, sha384 or sha512 hash of scripts or styles. This value consists of
the algorithm used to create the hash followed by a hyphen and the
base64-encoded hash of the script or style. When generating the hash, exclude
<script> or <style> tags and note that capitalization and whitespace matter,
including leading or trailing whitespace. In CSP 2.0, hash sources can be
applied to inline scripts and styles. Hash source expressions are allowed in [
CSP 3.0 ](https://www.w3.org/TR/CSP3/#external-hash) for external scripts in `
script-src ` directives. See the [ script-src ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/script-
src#unsafe_inline_script) and [ style-src ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/style-
src#unsafe_inline_styles) pages for more information and examples.

` 'strict-dynamic' `

    

The ` strict-dynamic ` source expression specifies that the trust explicitly
given to a script present in the markup, by accompanying it with a nonce or a
hash, shall be propagated to all the scripts loaded by that root script. At
the same time, any allowlist or source expressions such as ` 'self' ` or `
'unsafe-inline' ` are ignored. See [ script-src ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#strict-dynamic)
for an example.

` 'report-sample' `

    

Requires a sample of the violating code to be included in the violation
report.

` 'inline-speculation-rules' `

    

Allows the inclusion of [ speculation rules ](/en-
US/docs/Web/API/Speculation_Rules_API) in scripts (see also [ ` <script
type="speculationrules"> ` ](/en-
US/docs/Web/HTML/Element/script/type/speculationrules) ).

##  Relevant directives

Directives for which the above sources apply include:

  * [ Fetch directives ](/en-US/docs/Glossary/Fetch_directive) : 
    * [ ` default-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src)
    * [ ` child-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src)
    * [ ` connect-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src)
    * [ ` font-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src)
    * [ ` frame-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src)
    * [ ` img-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src)
    * [ ` manifest-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/manifest-src)
    * [ ` media-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/media-src)
    * [ ` object-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src)
    * [ ` prefetch-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src)
    * [ ` script-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)
    * [ ` script-src-elem ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem)
    * [ ` script-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-attr)
    * [ ` style-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src)
    * [ ` style-src-elem ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-elem)
    * [ ` style-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr)
    * [ ` worker-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src)
  * [ Document directives ](/en-US/docs/Glossary/Document_directive) : 
    * [ ` base-uri ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri)
    * [ ` sandbox ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox)
  * [ Navigation directives ](/en-US/docs/Glossary/Navigation_directive) : 
    * [ ` form-action ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action)
    * [ ` frame-ancestors ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-a