Skip to content
uencoder

CSP

CSP (Content Security Policy) declares, via an HTTP header, which resource origins a page may load, shrinking the attack surface for XSS and data injection.

Purpose

It defends against XSS and content injection by whitelisting the origins a page may load resources from.

Mechanism

The Content-Security-Policy header declares directives: default-src sets the default source, script-src the script sources, style-src the style sources, and so on. A nonce or hash permits inline scripts, and report-uri reports violations. Strict CSP uses a nonce plus strict-dynamic.

Use cases

  • XSS mitigation
  • Restricting third-party scripts
  • Inline script control
  • Violation reporting

Examples

  • Input 
    script-src 'self' 'nonce-abc'
    Output 
    Only same-origin and nonce-tagged scripts are allowed

    Whitelisting

Common errors

An overly strict CSP breaks page functionality
Observe first with Report-Only mode

Related terms

CORS
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that uses HTTP headers to control whether a page may access resources from a different origin, preventing cross-site reads.
GLOSSARY
XSS
XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.
GLOSSARY
Security Header
Security HTTP headers are response headers instructing the browser to enable security mechanisms, such as CSP, HSTS, and X-Frame-Options.
GLOSSARY
Content Security Policy
Content Security Policy (CSP) declares, via an HTTP header, a whitelist of sources a page may load resources from; it is the core mechanism for defending against XSS and content injection.
GLOSSARY

References