Overview

style-src-elem is a granular style directive that applies only to stylesheet elements — <link rel=stylesheet> and <style> blocks. It does not govern inline style= attributes. When omitted it falls back through style-src → default-src.

Details

When splitting style-src, style-src-elem governs external stylesheet loading and <style> elements, while style-src-attr governs inline style attributes. This lets you, for example, manage a trusted list of external stylesheets and <style> blocks via nonce (style-src-elem) while controlling inline style attributes with a separate policy (style-src-attr).

The split is useful when a framework dynamically injects <style> (e.g., CSS-in-JS): you can grant those a nonce for precise allowance while controlling inline style attributes differently. When style-src-elem is present, it takes precedence over style-src for style elements.

Syntax

Content-Security-Policy: style-src-elem 'self' 'nonce-r4nd0m'

Notes

• style-src-elem governs only stylesheet/<style> elements; style-src-attr governs only inline style attributes.
• When present, style-src-elem takes precedence over style-src for elements.
• Dynamic <style> injection (CSS-in-JS) can be allowed via a nonce under style-src-elem.

Related directives