WPT
wpt / content-security-policy / embedded-enforcement / subsumption_algorithm-strict_dynamic.html
Spec: Content Security Policy: Embedded Enforcement ↗
Runs: Chrome 155.0.8041.0 (wpt@07d3da1fa, 2026-09-04) | Firefox 157.0a1 (wpt@4fbf9ef4d, 2026-09-04) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-a7825 (wpt@4fbf9ef4d, 2026-09-04) | Servo Servo 0.6 (wpt@7e3d005d7, 2026-09-03) | Blitz a50cb8971 (wpt@a95401e4e, 2026-09-03)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 11/11 | 8/11 | 8/11 | 8/11 | 8/11 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| 'strict-dynamic' is ineffective for `style-src`. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' is ineffective for `img-src`. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' is ineffective for `frame-src`. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' is ineffective for `child-src`. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' is effective only for `script-src`. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| 'strict-dynamic' is properly handled for finding effective policy. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| 'strict-dynamic' makes host source expressions ineffective. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' makes scheme source expressions ineffective. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' makes 'self' ineffective. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' makes 'unsafe-inline' ineffective. | PASS | PASS | PASS | PASS | PASS | — |
| 'strict-dynamic' has to be allowed by required csp if it is present in returned csp. | PASS | FAIL | FAIL | FAIL | FAIL | — |