Content Security Policy

Content Security Policy reduces the impact of injection by controlling where scripts, styles, images, frames, workers, and network connections may load from. Strong policies prefer nonces or hashes over unsafe inline scripts, report violations, and are tested alongside build tooling and third-party integrations.

					Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-abc123';
  connect-src 'self' https://api.example.com;
				

Start with Content-Security-Policy-Report-Only, fix violations, then enforce. CSP limits blast radius; it does not replace output escaping or dependency audits.

On interviews: what CSP can limit and what it cannot fix alone.

Common pitfalls: a permissive policy full of wildcards is mostly documentation. CSP does not replace escaping, sanitization, or dependency hygiene.

The trade-off is convenience versus control — pick the mechanism that matches your coupling and performance budget.

Checklist:

• Prefer nonces or hashes for scripts.
• Avoid broad wildcards in production.
• Roll out report-only first.
• Still escape and sanitize untrusted HTML.