Content Security Policy (CSP)

Content Security Policy is a browser-enforced security control, usually delivered in the `Content-Security-Policy` HTTP response header. Its directives restrict which scripts, styles, images, frames, connections, and other resources a document may load or execute. An HTML `meta` element can deliver some policies, but the response header is preferred and supports directives that meta delivery does not.

Why it matters: CSP is defence in depth: an effective policy can limit the impact of content injection, including some cross-site scripting, but it does not replace output encoding, input handling, dependency controls, or other secure-development work. Start by inventorying required resources and testing a proposed policy with the `Content-Security-Policy-Report-Only` header. Review violations, account for browser support, and enforce in stages without weakening the policy broadly to silence reports. For scripts, nonce- or hash-based policies are generally stronger than wide host allowlists or `'unsafe-inline'`; generate a fresh unpredictable nonce for each response. Monitor reports carefully because they can contain sensitive page or URL details.