contentsecurity

Content security refers to mechanisms that control which content a web page or application is allowed to load and execute, with the aim of reducing the risk of content-based attacks such as cross-site scripting (XSS). The most widely used technology in this area is the Content Security Policy (CSP), a standard that lets developers specify whitelists of permitted sources for resources and actions.

A CSP is delivered to the user’s browser either via an HTTP header named Content-Security-Policy or, in some cases, via a meta tag in the page. It defines directives that govern different types of content, such as default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, and more. Each directive lists allowed sources, which can include self, specific domains, data:, blob:, or keywords like 'none', 'unsafe-inline', and 'unsafe-eval'. To enable safe inline or dynamic content without broadly disabling security, developers can use nonces or hash-based whitelisting. CSP policies can also specify reporting options through report-uri or the newer report-to endpoints, enabling automated violation collection.

Implementation commonly involves setting the policy in server responses; in some cases, a meta tag may be used for single-page applications or when header control is limited. CSP can be deployed in a report-only mode to monitor violations without blocking content, then switched to enforcement after testing. An example policy might include: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'https://fonts.googleapis.com'; img-src 'self' data:; object-src 'none'; report-uri https://example.com/csp-report.

Benefits include strong protection against XSS and mixed-content risks, but CSP is not a substitute for secure coding and input validation. Misconfigurations can break legitimate functionality, and older browsers may have limited or no CSP support. CSP continues to evolve, with CSP2 and CSP3 adding features such as report-to integration and improved handling of upgrades from insecure sources.