Content Security Policy

Content Security Policy (CSP) is a browser security mechanism that helps prevent cross-site scripting (XSS) and data injection attacks. It works by allowing web developers to specify which content sources are trusted, and instructing the browser to reject all others. How it works: CSP is delivered via an HTTP response header (Content-Security-Policy) or a meta tag. The policy consists of directives that specify allowed sources for different content types: scripts, styles, images, fonts, frames, and more. Example policy: Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; style-src 'self' https://fonts.googleapis.com Key directives: default-src sets the fallback for all resource types. script-src controls JavaScript. style-src controls CSS. img-src controls images. connect-src controls fetch/XHR/WebSocket. Deployment strategy: Start with Content-Security-Policy-Report-Only to monitor violations without enforcing, then iterate toward a strict enforced policy. Use nonces or hashes rather than unsafe-inline. Regularly audit your CSP with tools like Google's CSP Evaluator. CSP is not a silver bullet — it must be combined with input validation, output encoding, and other controls — but it is a critical layer in any mature web application security programme.