Skip to main content

Module csp_sri

ssg::audit::gates

Module csp_sri 

Source
Expand description

CSP + SRI hash validation gate.

Per page:

  • Asserts a Content-Security-Policy is present (either as a _headers rule or a <meta http-equiv="Content-Security-Policy"> tag).
  • Asserts every cross-origin <script src> and <link rel="stylesheet" href> carries an integrity SRI hash.

The CSP-consistency check across pages is a warning (different pages with different policies are a smell but legitimate when a single section needs a stricter policy).

Structsยง

CspSriGate
CSP + SRI hash validation gate.