The threat
In a cross site scripting attack, an attacker injects script into your page. A Content Security Policy (CSP) limits the damage by declaring which sources the browser may load and execute.
How it works
The server sends a Content Security Policy header listing directives. The browser enforces them, refusing anything outside the allowlist.
- script src controls where scripts may come from.
- style src controls stylesheet sources.
- default src is the fallback for unlisted resource types.
Inline scripts
A strict policy forbids inline scripts, which are a common injection vector. To allow trusted inline code you attach a per request nonce or a hash, so only your known snippets run.
Rolling it out
Start in report only mode, which logs violations without blocking, so you can find legitimate sources before enforcing. Then tighten the policy and remove unsafe allowances.
Key idea
A Content Security Policy allowlists resource sources to block injected scripts, using nonces for trusted inline code and report only mode for safe rollout.