SECURITY

Home › Glossary › Security· 116 ·

CSP

see-ess-peenoun

Filed underSecurityWeb Development

In brief · quick answer

Content Security Policy (CSP) is a browser security standard that uses HTTP headers to control which resources (scripts, styles, images, fonts) a page is allowed to load, preventing XSS and data injection attacks.

§ 1 Definition

CSP is a defense-in-depth security layer that allows web developers to declare approved sources of content that a browser should be allowed to load. By specifying a Content-Security-Policy HTTP header, you tell the browser to block or allow resources based on their origin and type. CSP can block inline scripts, eval(), connections to untrusted servers, and many other common attack vectors. It is one of the most effective defenses against Cross-Site Scripting (XSS) when properly configured.

§ 2 Directives and Policies

CSP directives control different resource types. `default-src` is the fallback for all resource types. `script-src` controls JavaScript sources. `style-src` controls CSS. `img-src` controls images. `connect-src` controls fetch/XMLHttpRequest targets. `frame-ancestors` controls embedding via iframes (anti-clickjacking). A policy like `default-src 'self'; script-src 'self' trusted-cdn.com; img-src *` means scripts can only load from the same origin or trusted-cdn.com.

§ 3 Reporting and Monitoring

CSP supports a `report-uri` or `report-to` directive that tells the browser to send JSON reports of policy violations to a specified endpoint. Deploy a monitor-only policy first using `Content-Security-Policy-Report-Only`, collect violation data, fix issues, and then enforce the policy. This staged rollout prevents accidentally breaking legitimate functionality.

§ 4 Strict CSP vs Domain Whitelisting

Using `'unsafe-inline'` or `'unsafe-eval'` in policies weakens or defeats CSP protection entirely. A strict CSP approach (using nonces or hashes instead of domain whitelists) is recommended by Google and OWASP as the most secure configuration. Nonce-based CSP generates a unique token per request that the browser matches against script tags.

§ 5 Note

CSP is not a silver bullet. It must be combined with proper input validation and output encoding. A misconfigured CSP can break a website. Always test in report-only mode before enforcing.

§ 6 Common questions

Q. Does CSP block all XSS attacks?: A. A properly configured strict CSP (nonce or hash-based, without unsafe-inline) blocks the vast majority of reflected and stored XSS. It does not protect against DOM-based XSS that manipulates existing trusted scripts.
Q. What is a CSP nonce?: A. A nonce is a cryptographically random, single-use token generated by the server for each HTTP response. It is embedded in the CSP header and in the nonce attribute of trusted script tags. Only scripts with a matching nonce execute.
Q. Can CSP prevent data exfiltration?: A. Yes. By restricting connect-src and using report-uri, CSP can detect and block attempts to send data to unauthorized external servers.

Key takeaways

CSP is a powerful defense against XSS and data injection attacks.
Use strict CSP with nonces or hashes, not domain whitelists with unsafe-inline.
Deploy in report-only mode first, fix violations, then enforce.
CSP complements but does not replace input validation and output encoding.

How Atomic Glue helps

Atomic Glue implements strict, nonce-based CSP on all client projects as part of our security-hardened deployment pipeline. See our Web Development services.

Get in touch

# CSP

Category: Security (also: Web Development)

Author: Atomic Glue Security Team

## Definition

## Directives and Policies

## Reporting and Monitoring

## Strict CSP vs Domain Whitelisting

Using `'unsafe-inline'` or `'unsafe-eval'` in policies weakens or defeats CSP protection entirely. A **strict CSP** approach (using nonces or hashes instead of domain whitelists) is recommended by Google and OWASP as the most secure configuration. Nonce-based CSP generates a unique token per request that the browser matches against script tags.

## Note

CSP is not a silver bullet. It must be combined with proper input validation and output encoding. A misconfigured CSP can break a website. Always test in report-only mode before enforcing.

## Common questions

Q: Does CSP block all XSS attacks?

A: A properly configured strict CSP (nonce or hash-based, without unsafe-inline) blocks the vast majority of reflected and stored XSS. It does not protect against DOM-based XSS that manipulates existing trusted scripts.

Q: What is a CSP nonce?

A: A nonce is a cryptographically random, single-use token generated by the server for each HTTP response. It is embedded in the CSP header and in the nonce attribute of trusted script tags. Only scripts with a matching nonce execute.

Q: Can CSP prevent data exfiltration?

A: Yes. By restricting connect-src and using report-uri, CSP can detect and block attempts to send data to unauthorized external servers.

## Key takeaways

CSP is a powerful defense against XSS and data injection attacks.
Use strict CSP with nonces or hashes, not domain whitelists with unsafe-inline.
Deploy in report-only mode first, fix violations, then enforce.
CSP complements but does not replace input validation and output encoding.

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/csp-security