What is a Content Security Policy?

What is a Content Security Policy?

A Content Security Policy (CSP) is a security feature that helps prevent various types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks. It allows web developers to specify which content sources are trusted.

How does it work?

CSP works by allowing developers to define a set of rules in HTTP headers or HTML meta tags. These rules specify which resources (like scripts, styles, images) can be loaded and executed by the browser.

Can you give me an example of a CSP header?

Sure! A simple CSP header might look like this: Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.com; This allows scripts to be loaded only from the same origin and from 'trusted.com'.

What happens if a resource is blocked by CSP?

If a resource is blocked by CSP, the browser will not load it, and it may log a violation in the console. This helps developers identify potential security issues.