Skip to main content
protocols.pageprotocols.page
security

CSP (Content Security Policy)

CSP is an HTTP header that restricts which resources (scripts, styles, images, frames) a page can load. CSP mitigates XSS by preventing execution of inline scripts and scripts from unauthorized origins. A strict CSP (script-src 'nonce-random') blocks injected JavaScript even if an attacker finds an injection point.

Definition

Content Security Policy defines a whitelist of allowed content sources via the Content-Security-Policy HTTP header. Each directive controls a resource type: script-src restricts JavaScript sources, style-src restricts CSS, img-src restricts images, connect-src restricts fetch/XHR/WebSocket targets, and frame-ancestors restricts which sites can embed yours (replacing X-Frame-Options). A strict CSP uses nonces (script-src 'nonce-abc123') – the server generates a random nonce per response and adds it to both the CSP header and each legitimate <script> tag. Injected scripts lack the nonce and are blocked. CSP violations are reported to a configured endpoint (report-uri or report-to) for monitoring without breaking the page (Content-Security-Policy-Report-Only). Start with report-only, monitor violations, fix legitimate sources, then enforce.

Examples

  • –Content-Security-Policy: default-src 'self'; script-src 'nonce-abc123'; style-src 'self'
  • –Content-Security-Policy-Report-Only: ... report-uri /csp-reports
  • –frame-ancestors 'self' replaces X-Frame-Options for clickjacking prevention

Related Protocols

http

Related Terms

CORS (Cross-Origin Resource Sharing)

CORS is a browser mechanism that controls which origins (domains) can make requests to your API. Without CORS headers, browsers block cross-origin XMLHttpRequest and fetch() calls. The server responds with Access-Control-Allow-Origin to permit specific origins. Misconfigured CORS (Allow-Origin: *) can expose APIs to credential theft.

XSS (Cross-Site Scripting)

XSS is a vulnerability where an attacker injects malicious JavaScript into a web page viewed by other users. Stored XSS persists in the database (comments, profiles). Reflected XSS arrives via URL parameters. DOM-based XSS executes entirely client-side. XSS enables session hijacking, credential theft, and defacement.