Content Security Policy
acronymweb devsecurity
Stands for: Content Security Policy (CSP)
A browser policy that restricts what a page may load and run, to blunt attacks like XSS.
A Content Security Policy lets a site declare which sources of scripts, styles, and other content are allowed, so injected malicious script is refused by the browser. It is a strong second line of defence behind proper output encoding.
A Content Security Policy tells the browser which sources of script, style, images and other resources it should trust for a page, and refuse everything else. It is the difference between an injected script executing and being blocked, which makes it the most effective mitigation available for cross-site scripting once output encoding has been done properly.
The hard part is that policies written the easy way do nothing. Allowing unsafe-inline, which is what most sites need at first because their markup is full of inline handlers and style attributes, removes essentially all the protection against the attack the policy was deployed to stop. Nonces and hashes are the way out, and they require changing how the application emits markup rather than adding a header.
Deployment has a safe path that is worth using. Report-only mode enforces nothing while sending violation reports, so you can see what a policy would break before it breaks it, which for a large existing site is invariably more than expected. The realistic sequence is report-only, fix the inline code the reports reveal, tighten, and only then enforce.
Also known as: csp, content security policy