Browser security boundaries
Add a Content Security Policy
Use CSP to restrict script and resource execution while keeping output handling and application design as the primary XSS defenses.
8 minute lesson
A Content Security Policy can limit what a page loads and executes. Treat it as a strong extra layer, not permission to render unsafe HTML.
Start with a report-only policy, inspect violations, then move toward nonces or hashes and fewer broad sources. Avoid unsafe-inline where possible. Keep the policy versioned beside the application and test important pages.
A new analytics script requires unsafe-inline, so the team adds it to script-src. That exception also lets an injected inline script run across the site.
A strict policy can break checkout or sign-in if required sources are missed. Start in report-only mode, then replace broad exceptions with nonces, hashes, or removed scripts.
Deploy a report-only policy and exercise the home, sign-in, and checkout paths. Record required violations, remove one unnecessary source, then test that an injected inline script is blocked under enforcement.
Lesson completed