Question 1

What is a Content Security Policy (CSP)?

Accepted Answer

A CSP is an HTTP response header that tells browsers which sources of content are allowed to load on your page. It prevents XSS, clickjacking, and other injection attacks by restricting scripts, styles, images, and other resources.

Question 2

Content-Security-Policy vs Content-Security-Policy-Report-Only?

Accepted Answer

Content-Security-Policy enforces the policy and blocks violations. Content-Security-Policy-Report-Only logs violations to a report endpoint without blocking anything. Use Report-Only mode to test your policy before enforcement.

Question 3

Should I use unsafe-inline and unsafe-eval?

Accepted Answer

Avoid them in production. unsafe-inline allows inline scripts and event handlers, defeating XSS protection. unsafe-eval allows eval() and similar APIs. Use nonces or hashes instead. During development, they are useful for quick testing.

Question 4

What does strict-dynamic do?

Accepted Answer

strict-dynamic allows scripts loaded by trusted scripts (via nonces or hashes) to load additional scripts. It is part of CSP Level 3 and works with nonce-based policies.

Question 5

How do I test my CSP header before deploying?

Accepted Answer

Use Report-Only mode first. Set Content-Security-Policy-Report-Only with your policy and a report-uri endpoint. Monitor violation reports for a few days, then switch to enforcement mode.

Content Security Policy (CSP) Header Generator