142
content security policy
also CSP
The browser only runs script from places you named. Inline script is how XSS survives.
What is content security policy?
CSP is a response header that restricts script, style, and connection sources. A strict policy with nonces blocks injected script even if an XSS hole exists. `unsafe-inline` and `unsafe-eval` undo it.
Why does content security policy matter when vibe coding?
Models add the header with `default-src *` or unsafe-inline so the page “works.” That is not a policy. Name a nonce or a hash.
How do you do content security policy?
Start in report-only if you must. Then enforce `script-src` with nonces. No wildcards on script. Fix violations. Do not add unsafe-inline to go green.
How do you ask a model for content security policy?
Set a content security policy. script-src allows only this origin plus nonces. No unsafe-inline, no unsafe-eval, no wildcard script sources. Do not weaken the policy to silence a violation; fix the markup.
What goes wrong with content security policy?
A meta tag policy and a header policy that disagree. Know which one the browser applies and keep one.