HTTP security header
Content-Security-Policy
The Content-Security-Policy (CSP) header lets a site declare approved sources for scripts, styles, images, and other content. A strict CSP is a powerful defense-in-depth measure against cross-site scripting: even if an attacker injects markup, the browser refuses to execute disallowed scripts. CSP mitigates impact but does not replace correct output encoding.
Example
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'Configuration guidance
- Prefer a strict, nonce- or hash-based policy over allowlisting hosts.
- Avoid 'unsafe-inline' and 'unsafe-eval', which defeat much of CSP's value.
- Set object-src 'none' and base-uri 'none' to close common bypasses.
- Roll out with Content-Security-Policy-Report-Only first to catch breakage.
Helps mitigate
Related headers
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.