Content-Security-Policy (CSP)
Content-Security-Policy (CSP) is an HTTP response header, specified by the W3C's Content Security Policy standard, that lets a site declare which sources of scripts, styles, images and other resources a browser is allowed to load, enforced by the browser regardless of what a page's own HTML or any injected markup requests. Its main practical use is mitigating content-injection attacks like cross-site scripting: a directive such as script-src 'self' gives granular control over inline script execution and dynamic code execution via eval(), stopping an injected <script> tag from running even if an attacker manages to insert one into the page. A directive is a name -- script-src, default-src as the fallback for unspecified types, frame-ancestors, and others -- followed by a list of allowed sources; the specification is explicit that CSP is not a replacement for careful input validation and output encoding, only an additional layer.
By AdminKit team, Netbase JSC · Updated