Content Security Policy

Content Security Policy: Browser policy restricting the sources permitted for scripts and other web content. Effectiveness is achieved through clear responsibilitiesResponsibilityAn explicitly assigned obligation to make, perform, or verify a security decision or task., documented guidelines, regular reviews, and measurable improvement goals.

How it works and where it fits

Content Security Policy is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.

Practical security relevance

Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.

Related concepts

• Cross-Site ScriptingCross-Site ScriptingInjection of executable script code into web application content.: Injection of executable script code into web application content.
• XSS Filter BypassXSS Filter BypassTechniques for bypassing protection mechanisms against cross-site scripting.: Techniques for bypassing protection mechanisms against cross-site scripting.
• Secure CodingSecure CodingProgramming practices aimed at avoiding common vulnerabilities and misconfigurations.: Programming practices aimed at avoiding common vulnerabilities and misconfigurations.
• Web Application FirewallWeb Application FirewallFilters HTTP traffic to protect web applications against common attacks.: Filters HTTP traffic to protect web applications against common attacks.