CSP (Content Security Policy)

Content Security Policy (CSP) is an HTTP response header, Content-Security-Policy, that tells the browser which origins are allowed to supply scripts, styles, images, frames and other resources. Anything outside the policy is blocked, which makes cross-site scripting (XSS) much harder to exploit.

Why it matters

If an attacker injects a <script> tag into your page, a strict CSP stops the browser from running it. It also helps you notice unexpected third-party scripts on your site.

Example

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; img-src 'self' data:; frame-ancestors 'none'; report-to csp

Here everything defaults to your own origin, scripts may also load from one CDN, and no site may frame your pages. To test without breaking anything, send Content-Security-Policy-Report-Only first and review the violation reports.

Common mistakes

• Using 'unsafe-inline' in script-src, which cancels most of the protection. Prefer nonces or hashes.
• Deploying an enforcing policy without a report-only trial, which silently breaks analytics, fonts or payment widgets.
• Whitelisting a broad host such as https://*.googleapis.com that can serve attacker-controlled content.
• Forgetting that frame-ancestors is the CSP way to stop clickjacking; it is not covered by default-src.

Related

• HSTS
• CORS
• WAF
• गाइड: Content Security Policy guide
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.