content security policy
Content Security Policy restricts resources and execution in the browser.
Use this when A site needs to limit script execution and external resource access.
without the term
“A security scan said we're missing a Content-Security-Policy header. Can you add one that blocks injected scripts but doesn't break our analytics and fonts?”
with the term · How do you ask a model for content security policy?
Add a CSP suited to this application. Verify legitimate interactions and blocked injected scripts without broadly allowing unsafe execution.
What is content security policy?
A Content-Security-Policy header tells the browser which scripts, styles, and connections a page may use. It limits the damage from injected scripts but does not prevent the injection.
Why does content security policy matter when vibe coding?
A policy can be weakened to silence errors without understanding what it permits.
How do you do content security policy?
Inventory required resources, use appropriate nonces or hashes, and test before enforcing the policy.
What goes wrong with content security policy?
Mistaking report-only monitoring for an enforced policy.