What is Content Security Policy (CSP)?

Short summary

Content Security Policy (CSP) is an HTTP header that whitelists trusted resources, protecting against XSS attacks by blocking unauthorized scripts. The browser validates each resource against the policy before loading it, significantly hardening frontend security. Strict CSP implementation requires careful configuration but offers powerful protection against injection attacks.

• •CSP is an HTTP header that whitelists trusted resource sources for JavaScript, CSS, images, and other assets
• •Primary defense against XSS attacks—browser blocks scripts from unapproved sources before execution
• •Additional benefits include clickjacking prevention and control over iframes, redirects, and form submissions

Generated with AI, which can make mistakes.