🛡️ Security

Content Security Policy (CSP)

An HTTP response header (or meta tag) that tells the browser which origins may supply scripts, styles and other resources for a page, with optional violation reporting. CSP restricts where code loads from; it cannot detect a script that was modified at an allowed origin.

📚 Deep Dive

Learn Article

Why a Third-Party Script Tag Hands Its Vendor Control of Every Page It Loads On

A vendor script runs as your page, on every page, and the trust chain behind it runs through the vendor's CDN, DNS and credentials. What CSP and Subresource Integrity cover, and what they cost.

intermediate 6 min read

Back to Glossary