https://nalar.dev/tags/content-security-policy/ Recent content in Content Security Policy on Nalar Hugo en-us Tue, 08 Sep 2026 00:00:00 +0700 https://nalar.dev/use-content-security-policy-as-xss-defense-in-depth/ Tue, 08 Sep 2026 00:00:00 +0700 https://nalar.dev/use-content-security-policy-as-xss-defense-in-depth/ <p>A web application can carefully encode output and still acquire an injection bug later through a new template, a third-party component, or unsafe client-side code. If attacker-controlled text reaches a place where the browser interprets it as JavaScript, the result can be cross-site scripting (XSS): code runs in the security context of the application and can act with whatever authority the page already has.</p> <p>The primary fix is to stop untrusted data from becoming executable code. <strong>Content Security Policy (CSP)</strong> adds a second boundary. The server sends a policy that tells the browser which scripts are allowed to execute. A well-designed policy can therefore reduce the impact of some XSS flaws even when the application accidentally places attacker-controlled markup into a page.</p>