Content Security Policy

Last reviewed: September 14, 2026

Content Security Policy

Content Security Policy (CSP) is a security feature that helps protect web applications from various types of attacks, such as cross-site scripting (XSS) and data injection. CSP achieves this by allowing web developers to control the resources that can be loaded and executed on a web page. It is implemented as a set of rules defined in HTTP headers, which specify which content sources are considered trustworthy. As of October 2023, CSP is widely used as a preventive measure to enhance the security of web applications.

Overview

Content Security Policy is a web security standard designed to prevent a range of attacks, including cross-site scripting (XSS) and data injection attacks. These attacks can be used to steal data, deface websites, or distribute malware. CSP allows web developers to specify which dynamic resources are allowed to load and execute on a web page. This is achieved by defining a whitelist of trusted sources for content such as scripts, stylesheets, images, and other media.

CSP is implemented by configuring HTTP response headers that instruct the browser on how to handle content loading. The policy is enforced by the web browser, which blocks any resource that does not match the specified policy. This helps to mitigate the risk of malicious content being executed within the context of a trusted web page.

Purpose

The primary purpose of Content Security Policy is to enhance the security of web applications by reducing the risk of content injection vulnerabilities. CSP aims to:

Prevent Cross-Site Scripting (XSS): XSS attacks occur when an attacker injects malicious scripts into a web page viewed by other users. CSP helps prevent these attacks by restricting the sources from which scripts can be loaded.

Mitigate Data Injection Attacks: By controlling the sources of content, CSP reduces the risk of attackers injecting malicious data into web applications.

Enforce Secure Content Loading: CSP ensures that only trusted content is loaded, thereby reducing the risk of executing untrusted or malicious resources.

Provide Reporting Mechanism: CSP can be configured to report violations to a specified endpoint, allowing developers to monitor and respond to potential security issues.

Implementation

Implementing Content Security Policy involves defining a set of rules in the HTTP headers of a web application. These rules specify which sources are allowed for different types of content. The CSP header can include directives such as:

default-src: Specifies the default policy for loading content such as scripts, styles, and images.
script-src: Defines the sources from which scripts can be loaded.
style-src: Specifies the sources for stylesheets.
img-src: Determines the sources for images.
connect-src: Controls the sources for XMLHttpRequest, WebSocket, and EventSource connections.
font-src: Specifies the sources for fonts.
object-src: Defines the sources for plugins like Flash.
media-src: Determines the sources for media files such as audio and video.

To implement CSP, developers must carefully define these directives based on the specific needs and architecture of their web application. It is important to test the policy thoroughly to ensure that legitimate content is not inadvertently blocked.

Content Security Policy is part of a broader set of security controls designed to protect web applications. Related controls include:

Secure HTTP Headers: Other HTTP headers, such as Strict-Transport-Security (HSTS) and X-Content-Type-Options, complement CSP by providing additional layers of security.

Input Validation and Sanitization: Ensuring that user input is properly validated and sanitized helps prevent injection attacks.

Domain Name System Security Extensions (DNSSEC): DNSSEC is a suite of specifications used to protect information provided by the Domain Name System (DNS) by verifying its origin and integrity. While not directly related to CSP, DNSSEC contributes to the overall security posture of web applications by ensuring the authenticity of DNS data.

Information-Theoretic Security: This is a theoretical approach to security that ensures a system's security is not dependent on computational assumptions. While CSP is a practical control, understanding information-theoretic security can inform the design of robust security architectures.