The W3C has undertaken standardization of CSP and you can find the W3C spec here. Old Document Alert: The old Mozilla-specific spec document has been separated into two smaller documents, and those are deprecated in favor of the W3C spec. But in case you want them, here they are. Normative: Security/CSP/Specification Non-Normative: Security/CSP/Design Considerations