Catalog
concept#Security#Architecture#Software Engineering

Content Security Policy (CSP)

Content Security Policy (CSP) is a browser-enforced mechanism to restrict allowed resource sources. CSP helps reduce cross-site scripting and other injection attacks by letting developers declare permitted sources for scripts, styles, images and frames.

Content Security Policy (CSP) is a browser-enforced security standard that lets web applications declare allowed sources for content such as scripts, styles, images and frames.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

Web servers: Nginx, Apache (header deployment)CDN configurations for allowed sourcesSIEM/logging systems for CSP reports

Principles & goals

Least privilege for resource sourcesIncremental rollout (report-only → enforcement)Transparency via reporting for observability
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Overly restrictive rules cause outages
  • Insufficient report processing prevents insights
  • False assumptions about third-party security
  • Start in report-only mode and analyze real violations.
  • Use nonces or hashes instead of broad 'unsafe-inline' rules.
  • Integrate reports into existing monitoring tools.

I/O & resources

  • Inventory of all included scripts, styles, images and frames
  • List of authorized domains and CDNs
  • Deployment mechanism for HTTP headers or meta tags
  • CSP header/meta tag configuration
  • Aggregated reports of policy violations
  • Updated policies and documentation

Description

Content Security Policy (CSP) is a browser-enforced security standard that lets web applications declare allowed sources for content such as scripts, styles, images and frames. It reduces cross-site scripting and injection risks by restricting resource loading and execution. CSP requires careful policy design, reporting, and incremental rollout to avoid breakage.

✔

  • Reduces XSS and script injection risks
  • Enables granular protection against unsafe third-party resources
  • Provides reporting for monitoring and forensic analysis

✖

  • Not all browsers fully support every CSP level
  • Incorrect policies can break site functionality
  • Does not protect against already compromised allowed resources

  • Number of CSP violations

    Number of policy violations reported per period; indicator for misconfiguration or attack attempts.

  • Error rate after policy rollout

    Share of user sessions functionally impacted by CSP violations.

  • Time to remediate a CSP violation

    Average time from receiving a report to implementing remediation.

E‑commerce platform reduces XSS incidents

An online shop deployed CSP in report-only mode, collected violations and enabled a restrictive policy after iteration. Reported XSS incidents dropped significantly.

SPA with CDN integration

A SPA explicitly allowed only certain CDNs and used nonces for dynamic scripts, preventing unexpected third-party executions.

Continuous monitoring via CSP reports

A team integrated CSP reports into their SIEM and detected faulty library updates and unusual request patterns early.

1

Perform inventory of resources and third parties.

2

Configure report-only CSP and collect reports.

3

Iteratively adjust policy and run staging tests.

4

Enable enforcement and establish monitoring.

5

Plan regular reviews and policy updates.

⚠️ Technical debt & bottlenecks

  • Legacy code with inline scripts that does not support nonces.
  • Missing automated tests for policy changes.
  • No central infrastructure to process CSP reports.
Legacy assets with inline scriptsIncomplete inventory of external dependenciesLimited observability for CSP reports
  • Setting 'unsafe-inline' across all pages to quickly satisfy functionality.
  • Using overly broad wildcards ('*') for critical directives.
  • Deploying an enforcement policy without prior staging tests.
  • Forgetting to process and monitor CSP reports.
  • Assuming CSP solves all web security problems.
  • Not considering subresource integrations (workers, frames).
Web security principles (XSS, CSP)Frontend architecture and dependency managementLogging/observability and SIEM basics
Availability of critical servicesIntegration needs with third partiesCompliance and auditability
  • • Browser compatibility of different CSP levels
  • • Legacy code that does not support nonces or hashes
  • • Business-required third-party integrations