What is CSP and how to configure it?

CSP (Content Security Policy) is a security mechanism for web applications that helps prevent attacks like XSS (cross-site scripting) and other malicious code injections.

CSP is set via the Content-Security-Policy HTTP header or a meta tag in HTML and defines which content sources are allowed for loading and execution (scripts, styles, images, fonts, etc.).

Example of CSP configuration in an HTTP header:

Content-Security-Policy: default-src 'self'; img-src https://trusted.com; script-src 'self' https://cdn.example.com

This means:

• By default, resources can only be loaded from the same source ('self').
• Images are allowed from https://trusted.com.
• Scripts are allowed from the current source and https://cdn.example.com.

To configure CSP, you need to:

• Determine which resources and from which sources the application needs.
• Formulate a policy with the necessary directives (default-src, script-src, style-src, img-src, etc.).
• Add the header on the server or in HTML.
• Test and adjust the policy to avoid blocking legitimate content.

CSP significantly enhances security by limiting the ability to inject malicious code.