Content Security Policy Basics
What problem does Content-Security-Policy (CSP) solve, and what is a strict default approach?
Answers use simple, clear English.
Quick interview answer
CSP restricts which scripts/styles/images/connect endpoints the browser may load/execute, mitigating XSS impact. Prefer nonces or hashes over unsafe-inline; default-src 'self'; upgrade-insecure-requests; avoid wildcards to CDNs you do not control. Report-Only helps roll out.
Detailed answer
CSP restricts which scripts/styles/images/connect endpoints the browser may load/execute, mitigating XSS impact. Prefer nonces or hashes over unsafe-inline; default-src 'self'; upgrade-insecure-requests; avoid wildcards to CDNs you do not control. Report-Only helps roll out. CSP is defense in depth — still encode output.
Full explanation
CSP is defense in depth — still encode output.
Real example & use case
Admin portal CSP blocks unexpected inline scripts even if an XSS bug injects a tag.
Pros & cons
Pros: shrinks XSS blast radius. Cons: hard with third-party widgets; misconfig breaks the UI.