Content Security Policy

web security

Definition

Content Security Policy (CSP)

A Content Security Policy is a defence-in-depth HTTP response header (Content-Security-Policy) that tells the browser which resources a page is allowed to load — scripts, styles, frames, connections, and more. Originally a XSS mitigation, CSP now also restricts framing, mixed content, and form submission. The policy is defined by the server and enforced by the browser.

script-src directives

Allowed-script directives

Directive	Effect
'self'	allow scripts from the same origin
advertisement.com	allow scripts whose src is this host
'nonce-a7b4f9420'	allow a <script> whose nonce attribute matches
'sha256-3i[…]FQ='	allow a script whose content hashes match
'strict-dynamic'	allow scripts dynamically added by an already-trusted script, and disable all host-based entities (e.g. 'self', hosts)

Content-Security-Policy: script-src 'self' advertisement.com 'nonce-a7b4f9420' 'strict-dynamic';

CSP can be bypassed

Several directives void the protection — most notably unsafe-inline. Other classes of bypass are listed in CSP Bypass.