Content Security Policy (CSP)
An HTTP response header and defense-in-depth security layer that restricts the domains and resource types (scripts, styles, images, iframes) a web browser is permitted to load and execute for a given page.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
Content Security Policy acts as the primary defense mechanism against Cross-Site Scripting (XSS) and data exfiltration attacks. By declaring directives such as script-src, style-src, and default-src, server operators restrict browser execution strictly to trusted sources, cryptographic hashes, or random nonces generated per HTTP request. When properly configured, CSP completely disables inline script execution (<script>alert(1)</script>) and dynamic evaluation (eval()), rendering reflected and stored XSS attacks benign even if an attacker manages to inject markup into the HTML DOM.
Technical Example & Practical Implementation
Eliminates unsafe-inline, restricts script origins to self and nonce, and blocks iframe clickjacking
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-rAnd0m12345' https://cdn.trusted.com;
style-src 'self' 'unsafe-inline';
img-src 'self' data: https://images.unsplash.com;
connect-src 'self' https://api.curious-techie.com;
font-src 'self' https://fonts.gstatic.com;
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
upgrade-insecure-requests;Related Topic Ecosystem & Next Steps
Related Technical Articles
Developer References & Specifications
Continue Learning
Content Security Policy (CSP) Hands-On Lab
Step into the interactive lab to defend a vulnerable DOM application with strict CSP nonces.