CSP and CORS
·527 words·3 mins
What is CSP # CSP stands for Content Security Policy and it is a security mechanism that helps to protect or mitigate some common attacks such as XSS (Cross-site scripting). It can be set by means of a Content-Security-Policy HTTP header or using an HTML meta tag.
HTTP header:
Content-Security-Policy: policy HTML Meta tag:
<meta http-equiv="Content-Security-Policy" content="policy"> A policy describes a set of directives, each composed of the area in which the rule is applied and the rule itself. The policy directive default-src 'self' says to load all content from the site’s origin, while if we want to load content from the site and from another trusted domain, the policy would be Content-Security-Policy: default-src 'self' *.trusted.com.