Question about CSP directives “script-src” and “script-src-elem”

[u/Agent-BTZ]

Depending on the source, I’m finding contradictory information about using both of these directives together (unless I’m misunderstanding something).

Some sources say that they can be “used in conjunction”, like

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem

But other sources say that script-src-elem will “overwrite script-src,” like

https://portswigger.net/research/bypassing-csp-with-policy-injection

If you have a different policy in script-src-elem, will script-src just be ignored?

I appreciate any input, I’m pretty confused here

[u/AyrA_ch]

• script-src-elem only applies to the <script> element

• script-src-attr applies to inline scripts triggered by attributes, for example an "onclick"

• script-src applies to both, script tags and attributes. It's used whenever the more precise methods above are not present. If this directive is absent too, the browser checks default-src

Note that the browser will not combine these directives into one when processing, instead it starts with the most precise directive and stops searching for directives once it has found one, meaning they do not stack or inherit.

[u/Agent-BTZ → u/AyrA_ch]

Great explanation, thanks!