Content Security Policy Level 2

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 40)
Intent stage: None

Breaking change: No
Enterprise impact: None
Spec maturity: Published standard

Summary

An evolution of the Content Security Policy specification, allowing developers to create a whitelist of sources of trusted content, and instructing the browser to only execute or render resources from those sources.

Standards & signals

Specification: http://www.w3.org/TR/CSP2/
Firefox: Positive
Safari: Shipped/Shipping
Web developers: Positive

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=content-security-policy-level-2
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Content%20Security%20Policy%20Level%202
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Content%20Security%20Policy%20Level%202
Baseline status: https://webstatus.dev/?q=Content%20Security%20Policy%20Level%202

View on chromestatus.com