← Back to glossary
🧱

Content Security Policy (CSP)

Web Security

Browser Extension XSS (Cross‑Site Scripting) Security Headers Mixed Content

Security header restricting resource loading/execution to mitigate XSS and data exfiltration.

Definition

CSP is an HTTP response header (or meta tag) that restricts script execution, resource origins, and connections. A strong CSP can significantly reduce XSS impact.

In plain English Security header restricting resource loading/execution to mitigate XSS and data exfiltration.

Why this matters

Why it matters: XSS can lead to session hijacking and privacy breaches; CSP adds defense-in-depth.

Example

Example: Use nonces/hashes for scripts, disallow inline scripts, and restrict connect-src to approved endpoints.