CSP (Content Security Policy)

Content Security Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images, fonts and frames a page may load. Anything not on the list is blocked, which greatly limits the damage of cross-site scripting (XSS) and data injection.

A policy is made of directives such as default-src, script-src, style-src and frame-ancestors. Inline scripts are blocked unless allowed with a nonce or hash. A Content-Security-Policy-Report-Only header lets you test a policy and collect violation reports before enforcing it.

ExampleHTTP

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; img-src 'self' data:; frame-ancestors 'none'

Authentication vs Authorization Brute Force Attack CSRF (Cross-Site Request Forgery)DDoS Attack Digital Signature Encryption End-to-End Encryption (E2EE)Hashing IDS and IPS (Intrusion Detection and Prevention)JWT (JSON Web Token)Malware Man-in-the-Middle (MITM) Attack

CSP (Content Security Policy)

More in Security