CSP

A CSP (Content Security Policy) is used to detect and mitigate certain types of website related attacks like Cross-site_scripting, clickjacking and data injections.

The implementation is based on an HTTP header called Content-Security-Policy.

Example

The following CSP header allows scripts only from the same origin and blocks inline scripts:

http
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'

See also