🧱
Content Security Policy (CSP)
Web Security
Security header restricting resource loading/execution to mitigate XSS and data exfiltration.
Definition
CSP is an HTTP response header (or meta tag) that restricts script execution, resource origins, and connections. A strong CSP can significantly reduce XSS impact.
In plain English
Security header restricting resource loading/execution to mitigate XSS and data exfiltration.
Why this matters
Why it matters: XSS can lead to session hijacking and privacy breaches; CSP adds defense-in-depth.
Example
Example: Use nonces/hashes for scripts, disallow inline scripts, and restrict connect-src to approved endpoints.