What is CSP (Content Security Policy)?

Content Security Policy (CSP) is a security mechanism for web applications that allows controlling which resources (scripts, styles, images, etc.) can be loaded and executed on a page.

CSP is set via an HTTP header or a meta tag and helps prevent attacks like Cross-Site Scripting (XSS) and other injections by restricting content sources.

An example of a simple CSP header:

Content-Security-Policy: default-src 'self'; img-src https://trusted.com; script-src 'self' https://apis.google.com

This means that by default, resources are only allowed from the same origin ('self'), images can be loaded from trusted.com, and scripts from the same domain and apis.google.com.

CSP helps enhance security by limiting the ability of malicious actors to inject harmful code.