CSP (Content Security Policy, W3C spec + RFC 7762) is an HTTP response header that tells browsers which sources of scripts, styles, images, fonts, connections, and frames are trusted. When properly deployed, CSP eliminates the vast majority of XSS attacks even when the underlying application has an injection vulnerability.
Header Format
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none';Common Directives
| Directive | Purpose |
|---|---|
default-src | Fallback for every fetch directive |
script-src | Allowed script sources |
style-src | Allowed CSS sources |
img-src | Allowed image sources |
connect-src | Allowed fetch / XHR / WebSocket targets |
frame-ancestors | Who can embed this page in a frame (replaces X-Frame-Options) |
report-uri / report-to | Where to send violation reports |
Deployment Pattern
Start with Content-Security-Policy-Report-Only — same syntax, no blocking, sends violation reports. Watch reports for a week. Fix real violations. Then flip to enforcing Content-Security-Policy.
Common Miss
'unsafe-inline'onscript-src— kills most of CSP’s XSS protection- Missing
frame-ancestors— clickjacking still possible viaX-Frame-Optionsgaps
Validate your CSP with the security headers audit.
Related
Check the HSTS glossary entry, the X-Frame-Options entry, and read the HTTP security headers explainer.