strict-dynamic CSP Directive (strict-dynamic)
Why You Should Care About strict-dynamic
strict-dynamic solves a practical CSP deployment problem. Modern web applications often load scripts that in turn load other scripts dynamically (like analytics, tag managers, or libraries from CDNs). Without strict-dynamic, you would need to allowlist every possible script origin in your CSP, which is fragile and difficult to maintain.
With strict-dynamic, you only need to add nonces to your first-party script tags. Those scripts can then load additional scripts dynamically, and the loaded scripts inherit trust. This makes CSP deployment feasible for complex applications that use module loaders, dynamic imports, or third-party script managers.
When strict-dynamic is present, allowlist-based source expressions like 'self' or specific hostnames are ignored for script loading. Only nonce-based or hash-based trust is used for the initial scripts. This is intentional and creates a stricter, more maintainable policy.
How to Test for strict-dynamic
A security audit evaluates your CSP for strict-dynamic usage. If you are implementing CSP for the first time, consider using script-src 'nonce-{random}' 'strict-dynamic' as your starting point. This provides strong XSS protection while accommodating dynamic script loading.
Run a Security Audit