CSP (Content Security Policy)
An HTTP header that tells the browser which scripts, styles and connections a page may use, limiting the damage of injected code.
If an attacker gets a script tag into your page (cross-site scripting), a strict CSP stops the browser from running it, because inline scripts and unknown origins are not allowed. It works best when designed in from the start: no inline scripts or event handlers, a short list of trusted sources. Retrofitting it onto a page full of third-party tags is slow work.
Related terms
- WAF (web application firewall): A filter in front of a web app that blocks malicious HTTP requests before they reach your code.
- Prompt injection: Instructions hidden in data (a web page, an email, a file) that the model follows as if they came from you.
- OAuth: A standard that lets an app act on a user’s account elsewhere (mail, calendar, files) without ever seeing the password.
- XSS (cross-site scripting): Attacker-controlled script running in your page in another user’s browser, with that user’s session.
