Content Security Policy (CSP): Hardening Web Applications

Content Security Policy (CSP) is one of the most effective security headers for preventing XSS attacks, yet it remains underutilized. CSP lets you define which sources of content are trusted, restricting what can execute on your site. A strict CSP can prevent inline script execution, restrict image sources, and block unsafe eval usage. Implementation starts with a report-only policy (Content-Security-Policy-Report-Only) to monitor violations without breaking existing functionality. The policy is defined with directives like default-src 'self', script-src 'strict-dynamic' https:, and style-src 'self' 'unsafe-inline' (temporary during migration). The 'nonce' approach provides the strongest protection—generating a cryptographic nonce for each script tag and including it in both the HTML and CSP header. For modern frameworks, nonce generation requires server-side rendering or middleware. Third-party scripts (analytics, widgets) need explicit allowlisting or the 'strict-dynamic' directive. Browser support is excellent, with reporting mechanisms for violations. Implementation complexity varies significantly by application architecture. Single-page apps with dynamic script injection are most challenging to secure. Tools like Google's CSP Evaluator help validate policies. The transition involves identifying all legitimate sources, addressing inline scripts (moving to external files or adding nonces), and gradually tightening policies. CSP is defense-in-depth—it won't fix all vulnerabilities but severely limits XSS exploitation capabilities. For production applications, implementing CSP significantly improves security posture.