What is Content Security Policy?
Content Security Policy (CSP) is an HTTP header that allows site operators to restrict the origins from which scripts, styles, images, and fonts can load and execute. It is the primary browser-level defense against Cross-Site Scripting (XSS) and data injection.
Strict Nonce-Based CSP vs Allowlist CSP
Modern security standards (OWASP and Google Web Security) recommend nonce-based strict CSP over domain allowlists. Domain allowlists are prone to bypasses through open redirects or CDN-hosted script gadgets, whereas cryptographic nonces (e.g. script-src 'nonce-xyz') ensure only server-authorized script tags execute.
Testing with Report-Only Mode
Before enforcing a CSP, deploy it using Content-Security-Policy-Report-Only. Violations are sent to a reporting endpoint (report-to or report-uri) without breaking client functionality, allowing you to fine-tune directives before strict enforcement.