CSP policies regress silently. That’s the whole problem. Someone adds 'unsafe-inline' to script-src to unblock a third-party widget on a deadline. It ships. The policy that took a quarter to tighten is now decorative, and nothing anywhere fails. No test breaks, no alert fires, no reviewer catches it because the diff is one token long and the PR is about a marketing pixel. You find out months later, from an XSS report, if you find out at all. ...
There’s no Python library for parsing Content Security Policy headers. I checked PyPI, I checked GitHub — nothing. Google has a CSP Evaluator web tool and an npm package, but if you want to analyze CSP programmatically in Python — for recon scripts, bug bounty automation, or CI pipelines — you’re on your own. So I built one. csp-toolkit is a Python library and CLI tool that parses CSP headers, runs 21 weakness checks, finds bypass vectors against a database of 79 known-exploitable domains, scores policies A+ to F, and does a lot more. The current release is v0.8.1 on PyPI (changelog, docs). ...
Content Security Policy (CSP) is a browser security mechanism that controls which resources a web page is allowed to load. By declaring a policy via HTTP header, you tell the browser exactly which scripts, styles, images, fonts, and connections are permitted. Anything not explicitly allowed is blocked. CSP is one of the most effective defenses against Cross-Site Scripting (XSS) and data injection attacks. How CSP Works CSP is delivered as an HTTP response header: ...