# X_CSP_DIRECTIVE_INVALID

## Means

a csp extension would emit something other than the directive it names

## Typical cause

a `security.csp.extend` key that is not a CSP directive token, or a source carrying one of the header's own separators — `{ 'x; script-src *': [] }` is not one badly named directive, it is a second directive nobody declared, widening the one the framework locks down hardest. Refused at `defineHttpConfig`, because there is no encoding for a CSP directive and escaping it at emission time is not a repair

## Fix

in the `configureHttp({ security: { csp: { extend } } })` call write one entry per directive, each source its own array element — a directive name is `[a-z][a-z0-9-]*`, and no source may contain a space, a comma or a semicolon

[HTTP](/error-codes#http)