Web Security · Middle · Question 20 of 75

Is a CSP set in a `<meta http-equiv>` tag the same as one in a response header?

1Yes, they're identical in every way
✓Correct answer: Mostly, but some directives like frame-ancestors and reporting only work in the header
3No, browsers ignore CSP in meta tags

Explanation

The meta tag also applies only after it's parsed. For full control, send CSP as an HTTP header.

Further reading

MDN: Content Security Policy ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.