thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Content Security Policy (CSP)

An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.

Definition

Directives such as default-src, script-src, object-src, frame-ancestors and report-to restrict content. Strict policies use nonces or hashes instead of host allowlists and avoid 'unsafe-inline'. CSP is defense in depth; it does not replace output encoding.

Example

Content-Security-Policy: script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; frame-ancestors 'self'

Exam tip

CSP mitigates XSS impact; frame-ancestors supersedes X-Frame-Options for clickjacking.

Related terms