Content Security Policy (CSP) implementation
The Content-Security-Policy HTTP header provides fine-grained control over the code that can be loaded on a site, and what it is allowed to do.
Problem
The main problem this article focuses on is cross-site scripting (XSS) attacks. These are generally due to a lack of control and awareness of the sources from which site resources are loaded. This problem gets more difficult to manage as sites become larger and more complex and increasingly rely on third-party resources such as JavaScript libraries.
Note: CSP is one part of a complete strategy for protecting against XSS attacks. There are other factors involved, such as output encoding and sanitization, which are also important.
CSP can also help to fix other problems, which are covered in other articles:
- Preventing clickjacking by stopping your site being embedded into