Web Security · Junior · Question 63 of 75

What is a Content Security Policy (CSP)?

1A list of words that users are not allowed to post
✓Correct answer: A response header that tells the browser which sources of scripts, styles and other resources are allowed
3A legal document describing how the site uses content

Explanation

If an attacker injects a script that doesn't match the policy, the browser refuses to run it. CSP is a strong second layer against XSS.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.