查看“︁Content Security Policy”︁的源代码

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution.

To enable CSP, you need to configure your web server to return the <syntaxhighlight lang="bash" inline>Content-Security-Policy</syntaxhighlight> HTTP header. (Sometimes you may see mentions of the <syntaxhighlight lang="bash" inline>X-Content-Security-Polic</syntaxhighlight>y header, but that's an older version and you don't need to specify it anymore.)

Alternatively, the <meta> element can be used to configure a policy, for example:

<syntaxhighlight lang="html">
<meta
  http-equiv="Content-Security-Policy"
  content="default-src 'self'; img-src https://*; child-src 'none';" />
</syntaxhighlight>


* https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

[[Category:Protocol]]
[[Category:HTTP]]