Content Security Policy (CSP)

Overview

Content Security Policy lets a website declare allowed sources and behaviors through HTTP headers or limited markup. Directives can control scripts, styles, images, frames, connections, form destinations, base URLs, and other browser actions relevant to content injection.

A strong policy can reduce the impact of cross-site scripting and malicious content, especially when it avoids broad wildcards and unsafe inline execution. CSP remains defense in depth because it does not repair the underlying injection or authorization vulnerability.

Teams should begin with reporting, inventory legitimate sources, use nonces or hashes where appropriate, remove unsafe allowances, and monitor violations. Policies require testing across pages and third-party integrations because an overly strict deployment can break essential functionality.

An auditable record of Content Security Policy (CSP) should link requests, deployments, configuration changes, logs, and service responses to the governing policy or model version, source evidence, decision, approver, exception, action, and final outcome.

Unlike a general browser-security recommendation, CSP is used to restrict permitted content sources and execution behavior; for example, a report-only policy can reveal violations before blocking is enforced.

Content Security Policy is a browser-enforced policy that restricts which resources a web page may load, execute, embed, or connect to. CSP limits what injected content can do, but secure coding and output handling must still remove the underlying vulnerability.

A production treatment of Content Security Policy (CSP) should test a browser-enforced policy that restricts which resources a web page may load, execute, embed, or connect to within the relevant asset, decision, or service state. The Content Security Policy context record for execute, embed, and connect to should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Content Security Policy (CSP) should determine whether safeguards addressing execute, embed, and connect to changed exposure in practice, not merely whether a document or setting existed.