CSP
Content Security Policy
Content Security Policy, not to be confused with CSP for a cloud service provider. A response header telling the browser which sources of scripts, styles, images and other content a page may load or run. It limits the damage of an injection flaw but does not fix it (W3C Content Security Policy Level 3).
- Defined in
- W3C Content Security Policy Level 3
Covered in
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Case study: the polyfill.io CDN takeover (2024)
How the sale of the polyfill.io domain and project in February 2024 turned a script tag on more than 100,000 websites into a channel for malicious redirects by June, why Subresource Integrity could not have protected it, and the controls that would have.
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Map PCI DSS Requirement 6 to engineering practice and evidence
Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Practice: XSS lab: Render a model’s answer as text instead of active markup · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy · Local project: Run model-generated Python in a locked-down container