Glossary term
What is CSP (Content Security Policy)?
CSP stands for Content Security Policy.
In The Browser Contract
A response header that lists which sources of scripts, styles and frames are allowed. It is a safety net if escaping fails.
Learn it properly · The Browser ContractLesson 7: Frontend Security Checklist: XSS, CSP, Clickjacking and Supply ChaindangerouslySetInnerHTML, CSP nonces, frame-ancestors, Subresource Integrity and risky packages. Each one asks: what would you check in a code review?In Security for Developers
A response header that tells the browser what scripts and resources it may run or load. It limits the damage if a script gets injected.
Learn it properly · Security for DevelopersLesson 2: XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.