Skip to content
Header Hawk

script-src-elem

script-src-elem covers <script> elements: both the URLs they load and the code inside inline blocks. It does not cover event handler attributes, which are script-src-attr’s job.

Most policies never set it. It matters anyway, because it is the directive browsers name in reports when a <script> is refused under a plain script-src rule.

Syntax

Section titled “Syntax”
Content-Security-Policy: script-src-elem 'none';
Content-Security-Policy: script-src-elem <source-expression-list>;

What it controls

Section titled “What it controls”
  • <script src="..."> requests.
  • Inline <script> blocks, including their nonces and hashes.

What it does not control

Section titled “What it does not control”
  • Inline event handler attributes such as onclick - see script-src-attr.
  • eval() and the other dynamic-code entry points, which stay with script-src.
  • XSLT stylesheets.

Fallback

Section titled “Fallback”

If script-src-elem is absent, the browser consults script-src, and then default-src. The full chain is script-src-elem → script-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: script-src-elem 'self' 'nonce-{RANDOM}' 'strict-dynamic'
  • Set it only when you want elements and attributes to differ - typically a strict script-src-elem alongside script-src-attr 'none'.
  • If both halves should be identical, write script-src once instead. Two directives that always agree are two directives to keep in sync.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

An external script from an allowed origin:

<script src="https://cdn.example.com/app.js"></script>

Blocked

Section titled “Blocked”

Under script-src-elem 'self', a third-party tag:

<script src="https://widget.vendor.example/embed.js"></script>

Browser support

Section titled “Browser support”
  • Baseline: widely available across browsers since December 2022.
  • 'unsafe-hashes' does not apply to this directive - it exists for attributes, which this directive does not cover.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective script-src-elem
effectiveDirective script-src-elem
blockedUri https://widget.vendor.example/embed.js, inline
Issue title script-src-elem blocking widget.vendor.example
  • This is the directive name you will see most often in HeaderHawk, whether or not your policy contains the words script-src-elem. A report naming it does not mean somebody set it; it means a <script> was refused.
  • violatedDirective and effectiveDirective both read script-src-elem in current browsers. Older reports sometimes carry the policy’s own text - script-src 'self' - in violatedDirective, which is why HeaderHawk groups on the effective directive.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.