What is Content Security Policy?

What is Content Security Policy?

Content Security Policy (CSP) is a security feature that helps prevent various types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks. It allows web developers to specify which content sources are trusted.

How does CSP work?

CSP works by allowing developers to define a set of rules in HTTP headers or HTML meta tags. These rules specify which resources (like scripts, styles, and images) can be loaded and executed by the browser.

Can you give me an example of a CSP rule?

Sure! A simple CSP rule might look like this: Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.com;. This means that by default, only resources from the same origin can be loaded, but scripts can also be loaded from 'https://trusted.com'.

What happens if a CSP rule is violated?

If a CSP rule is violated, the browser will block the resource from loading and may log a violation report if configured to do so. This helps developers identify and fix potential security issues.