Content-Security-Policy Header — SAMPLE
SAMPLE CSP header line for CSP parsers and security-header scanners.
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.sample.example; img-src 'self' data: https:; connect-src 'self' https://api.sample.example; frame-ancestors 'none'; base-uri 'self'
Specifications
- Directive Count
- 6
What is a .headers file?
A .headers text fixture is a plain-text dump of HTTP response headers (CORS, CSP, HSTS, etc.) used for policy and scanner tests.
How to use this file
Use SAMPLE .headers files to test security-header parsers and linters against documented good and misconfigured policies.
How to use this file for testing
“Content-Security-Policy Header — SAMPLE” is a deterministic Novus Examples fixture for API testing. OpenAPI/Swagger specs, GraphQL SDL, JSON Schema, paginated and problem+json error payloads, and webhook samples — for testing API clients, mock servers, contract tests, and schema validators.
Documented properties for this file: HEADERS · 208 bytes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
Related files
- headersBrowser Security Headers Pack — SAMPLESAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
- headersCORS Misconfigured Headers — SAMPLEIntentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
- headersCORS Response Headers — SAMPLESAMPLE CORS response header block as plain text for header parsers and policy tests.
- headersHSTS Header — SAMPLESAMPLE Strict-Transport-Security header for TLS policy scanners.
- headersX-XSS-Protection Header — SAMPLESAMPLE X-XSS-Protection: 0 header for legacy header scanners.
- jsonOAuth Device Code Response — SAMPLESAMPLE OAuth device-authorization response for device-flow client tests.
Generated by generation/security_wave_g.py. Free for any use, no attribution required — license.