What is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP header that tells browsers which sources of scripts, styles and other resources a page may load, limiting the damage of cross-site scripting.
A Content Security Policy (CSP) is an HTTP response header that lists which sources a page is allowed to load scripts, styles, images, frames and other resources from. If an attacker manages to inject a script into your page, the browser refuses to run it unless it matches the policy.
Example
Content-Security-Policy: default-src 'self'; script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none'
Key ideas
'unsafe-inline'allows any inline script and removes most of CSP's protection against cross-site scripting.- Nonces and hashes allow specific inline scripts without allowing all of them.
frame-ancestorscontrols who may embed your page in an iframe, replacingX-Frame-Options.- Report-only mode (
Content-Security-Policy-Report-Only) lets you test a policy without breaking anything.
Related
- Security headers checker
Free security headers checker. Test HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, SSL certificate expiry, TLS version and mixed content.
- Security headers explained: a practical setup for Next.js, Nginx and Caddy
What each HTTP security header does, sensible values to start with, and copy-paste configuration for Next.js, Nginx and Caddy, including a nonce-based Content-Security-Policy.
- What is HSTS (HTTP Strict Transport Security)?
HSTS is a security header that tells browsers to always use HTTPS for a site, preventing downgrade attacks and insecure first requests.