Content Security Policy (CSP)

Content Security Policy, or CSP, is a security policy a website sends to the browser. Its directives can specify which scripts and other resources a document may load. The browser applies the rules that have been defined; the mere presence of a CSP says nothing about how strict it is.

Distinguish reporting from enforcement

A fictional project portal initially plans a policy using the Content-Security-Policy-Report-Only response header with a reporting endpoint configured. This policy reports violations but does not block them. A report can also point to a needed resource missing from the proposed rules; it is not evidence of an attack by itself.

The enforcing version is delivered through Content-Security-Policy. It blocks violations of the rules it covers. When switching, the team therefore also needs to check that the portal's required features still work. An additional enforcing policy already present can remain effective during the trial.

An additional layer of protection

MDN describes CSP as an additional defence against cross-site scripting, among other uses. Safe output locations and the necessary sanitisation of permitted HTML are still required. The portal example explains the two modes; it contains no configuration tested on a real website.

Sources

• MDN — Content Security Policy (CSP)