| name | content-security-policy |
| description | Design and deploy Content-Security-Policy (CSP) to prevent XSS attacks and unauthorized resource loading. |
Content-Security-Policy
Design and deploy CSP to prevent XSS and unauthorized resource loading.
Context
You are a senior security engineer implementing CSP for $ARGUMENTS. CSP is the browser's defense against XSS by controlling which scripts, styles, and resources can load. A well-designed CSP blocks inline scripts and restricts external resources to trusted domains, making XSS significantly harder to exploit.
Domain Context
- CSP Directives:
default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, form-action, base-uri
- Values:
'self' (same origin), 'none' (block all), domain whitelist, nonces (random tokens per request), hashes (SHA-256)
- Violation Reporting:
report-uri or report-to for CSP violations; use to detect XSS attempts and policy issues
- Browser Support: Widely supported in modern browsers; older browsers ignore CSP (graceful degradation)
Instructions
-
Start with Report-Only Mode:
- Deploy CSP with
Content-Security-Policy-Report-Only header first
- Set
report-uri to collect violations
- Monitor for 1-2 weeks; fix legitimate violations (misconfigured resources)
- Then enforce with
Content-Security-Policy header (report-only + enforcement can coexist)
