<h3 id="framework-directives">Directives</h3>

Each <a for="/">policy</a> contains an <a>ordered set</a> of <dfn export>directives</dfn> (its

<a for="policy">directive set</a>), each of which controls a specific behavior. The directives

<a for="content security policy object">directive set</a>), each of which controls a specific behavior. The directives

defined in this document are described in detail in [[#csp-directives]].

Each <a>directive</a> is a <dfn for="directive" export>name</dfn> /

Each <a>violation</a> has a

<dfn for="violation" id="violation-disposition" export>disposition</dfn>, which is the

<a for="policy">disposition</a> of the <a for="/">policy</a> that has been violated.

<a for="content security policy object">disposition</a> of the <a for="/">policy</a> that has been violated.

Each <a>violation</a> has an

<dfn for="violation" id="violation-effective-directive" export>effective directive</dfn>

2. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:

1. If |policy|'s <a for="policy">disposition</a> is "`enforce`",

1. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`",

then skip to the next |policy|.

2. Let |violates| be the result of executing

3. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:

1. If |policy|'s <a for="policy">disposition</a> is "`report`",

1. If |policy|'s <a for="content security policy object">disposition</a> is "`report`",

then skip to the next |policy|.

2. Let |violates| be the result of executing

1. Execute [[#report-violation]] on the result of executing

[[#create-violation-for-request]] on |request|, and |policy|.

2. If |policy|'s <a for="policy">disposition</a> is "`enforce`",

2. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`",

then set |result| to "`Blocked`".

Note: This portion of the check verifies that the page can load the

3. <a for=list>For each</a> |policy| of |element|'s {{Document}}'s <a for="/">global object</a>'s

<a for="global object">CSP list</a>'s [=CSP list/policies=]:

1. <a for=set>For each</a> |directive| of |policy|'s <a for="policy">directive set</a>:

1. <a for=set>For each</a> |directive| of |policy|'s <a for="content security policy object">directive set</a>:

1. If |directive|'s <a for="directive">inline check</a> returns

"`Allowed`" when executed upon |element|, |type|, |policy| and |source|,

7. Execute [[#report-violation]] on |violation|.

8. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

8. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

4. Return |result|.

4. Execute [[#report-violation]] on |violation|.

5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

5. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

3. If |result| is "`Allowed`", and if |navigation request|'s

5. Execute [[#report-violation]] on |violation|.

6. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

6. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

4. Return |result|.

4. Execute [[#report-violation]] on |violation|.

5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

5. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

3. <a for=list>For each</a> |policy| of |navigation request|'s <a for="request">policy container</a>'s

4. Execute [[#report-violation]] on |violation|.

5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

5. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

4. Return |result|.

4. Execute [[#report-violation]] on |violation|.

5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then

5. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`", then

set |result| to "`Blocked`".

3. Return |result|.

:: The <a lt="serialized CSP">serialization</a> of |violation|'s

<a for="violation">policy</a>

: "`disposition`"

:: The <a for="policy">disposition</a> of |violation|'s

:: The <a for="content security policy object">disposition</a> of |violation|'s

<a for="violation">policy</a>

: "`status-code`"

:: |violation|'s <a for="violation">status</a>

{{SecurityPolicyViolationEvent/violatedDirective}} are the same value.

This is intentional to maintain backwards compatibility.

4. If |violation|'s <a for="violation">policy</a>'s <a for="policy">directive

4. If |violation|'s <a for="violation">policy</a>'s <a for="content security policy object">directive

set</a> contains a <a>directive</a> named "<a>`report-uri`</a>"

|directive|:

1. If |violation|'s <a for="violation">policy</a>'s

<a for="policy">directive set</a> contains a <a>directive</a> named

<a for="content security policy object">directive set</a> contains a <a>directive</a> named

"<a>`report-to`</a>", skip the remaining substeps.

2. <a for=set>For each</a> |token| of |directive|'s

is, the latter overrides the former, allowing for backwards compatibility

with browsers that don't support the new mechanism.

5. If |violation|'s <a for="violation">policy</a>'s <a for="policy">directive

5. If |violation|'s <a for="violation">policy</a>'s <a for="content security policy object">directive

set</a> contains a <a>directive</a> named "<a>`report-to`</a>"

|directive|:

1. Let |source list| be null.

2. If a <a>directive</a> whose <a for="directive">name</a> is

"`base-uri`" is present in |policy|'s <a for="policy">directive

"`base-uri`" is present in |policy|'s <a for="content security policy object">directive

set</a>, set |source list| to that <a>directive</a>'s

<a for="directive">value</a>.

3. Execute [[#report-violation]] on |violation|.

4. If |policy|'s <a for="policy">disposition</a> is "`enforce`",

4. If |policy|'s <a for="content security policy object">disposition</a> is "`enforce`",

return "`Blocked`".

Note: We compare against the fallback base URL in order to deal correctly with things like

Given a {{Document}} or <a for="/">global object</a> |context| and a <a for="/">policy</a>

|policy|:

1. If |policy|'s <a for="policy">disposition</a> is not "`enforce`", or

1. If |policy|'s <a for="content security policy object">disposition</a> is not "`enforce`", or

|context| is not a {{WorkerGlobalScope}}, then abort this algorithm.

2. Let |sandboxing flag set| be a new [=/sandboxing flag set=].

<a>`frame-ancestors`</a> directive <em>overrides</em> the

\`<code>[:X-Frame-Options:]</code>\` header. If a resource is delivered with

a <a for="/">policy</a> that includes a <a>directive</a> named

<a>`frame-ancestors`</a> and whose <a for="policy">disposition</a> is

<a>`frame-ancestors`</a> and whose <a for="content security policy object">disposition</a> is

"`enforce`", then the \`<code>[:X-Frame-Options:]</code>\` header will be

ignored, per <cite>HTML</cite>'s processing model.