CSP

Simple definition

CSP limits the authorized sources for scripts, styles and other web content.

Technical definition

Content- 8.1–3 is a header HTTP which defines directives such as default-src, script-src or frame-ancestors.

What is it used for?

reduce some XSS risks and control resources loaded by a page.

Practical example

a policy CSP allows scripts only from the domain of the site and a CDN approved.

Common issues

• script blocked
• nuncio CSP absent
• too permissive

Key takeaway: Always adapt the diagnosis to the product version and the architecture actually deployed.