Content Security Policy
Content Security Policy restricts which sources and execution forms a page may use. It can reduce the impact of script injection.
What it is
Content Security Policy restricts which sources and execution forms a page may use. It can reduce the impact of script injection.
Why it matters
A policy is an additional defense; unsafe insertion of untrusted HTML is still a bug.
Example
connect-src can limit model and API requests to the same origin, while script-src limits executable script sources.
Technical detail
Deliver CSP through an HTTP response header. Directives such as script-src, connect-src, and frame-ancestors control different capabilities.
When to use it
Test actual modules, WASM, workers, and styles before enforcing a changed policy.
Go deeper
Sources
More in Web platform
Assembled from the ReLU.chat curated knowledge base. These explanations are concise on purpose; check the sources for anything important.