---
schema_version: "1"
id: e28c0e78f086a5fc1f064271e1d19202acc40e4608249cd1f2a725717f179a6b
title: ContentSecurityPolicy object
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwr-node/lwr/references/packages-reference/lwrjs-security/contentsecuritypolicy.md
canonical_url: https://developer.salesforce.com/docs/platform/lwr/references/packages-reference/contentsecuritypolicy.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f54868de5bfdd5a42f2163c2a84bdb1456e836f2aa2fdd4234b3d045e54385e3
products:
  - Lightning Web Runtime
---
# ContentSecurityPolicy object

Use `ContentSecurityPolicy` to configure the [`Content-Security-Policy`](https://developer.salesforce.com/docs/platform/guides/lwr-security.md#content-security-policy) header.

## Syntax

```
interface ContentSecurityPolicy {
    useDefaults: boolean;
    reportOnly: boolean;
    resourceHashing: boolean;
    directives: { [key: string]: string[] };
}
```

## Options

| Option            | Description                                                                                                                    | Default Value               |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------- |
| `useDefaults`     | When `true`, it merges the default header directives with any custom directives you pass in via the `directives` object.       | `false`                     |
| `reportOnly`      | Set this option to one or more policy directives. For example: `default-src https:; report-to /csp-violation-report-endpoint/` | `'content-security-policy'` |
| `resourceHashing` | When `true`, inline scripts are hashed for the header.                                                                         | `true`                      |
| `directives`      | In this section, you can configure directives for the `Content-Security-Policy` header.                                        |

## Directives

You can customize these directives for a `Content-Security-Policy` header. Set values for them in the `directives` section of a `ContentSecurityPolicy` object.

- [`default-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src)
- [`base-uri`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri)
- [`child-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src)
- [`connect-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src)
- [`font-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src)
- [`form-action`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action)
- [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors)
- [`frame-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src)
- [`img-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src)
- [`manifest-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/manifest-src)
- [`media-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/media-src)
- [`object-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src)
- [`prefetch-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src)
- [`sandbox`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox)
- [`script-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)
- [`script-src-attr`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-attr)
- [`script-src-elem`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem)
- [`style-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src)
- [`style-src-attr`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr)
- [`style-src-elem`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-elem)
- [`upgrade-insecure-requests`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests)
- [`worker-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src)

## Example

For example, this `ContentSecurityPolicy` object tells the `Content-Security-Policy` header to use the `media-src 'self'` directive in addition to to the default directives.

```
"contentSecurityPolicy":
    {
        "useDefault": true,
        "resourceHashing": false,
        "directives": "media-src 'self';"
    }
```

This `ContentSecurityPolicy` has `useDefaults: false`, which removes all the default directives and values. It only defines a value for the `media-src` directive, so all other directives accept content from any source.

```
"contentSecurityPolicy":
    {
        "useDefault": false,
        "resourceHashing": false,
        "directives": "media-src 'self';"
    }
```

**See Also**

- [Guide: @lwrjs/security](https://developer.salesforce.com/docs/platform/guides/lwr-security.md)