Fundamentos de la web
Content Security Policy: limit what a page may execute
A browser-enforced policy can reduce injection exposure, but its actual directives determine the protection.
Los artículos de investigación y las referencias se publican en inglés. La navegación está disponible en siete idiomas.
En este artículo
The allowed sources
Content Security Policy lets a site declare restrictions on resources and execution. A script policy can specify trusted sources and use nonces or hashes for intended scripts. Other directives govern objects, frames and additional resource types.
A policy's presence is not enough. Broad allowances can undermine the intended restriction, and report-only mode records potential violations without enforcing the same block. The deployed header is the relevant evidence.
What it cannot decide
CSP does not judge whether an allowed application asks for a harmful approval. If the application's own logic creates a misleading transaction request, the browser can faithfully enforce the policy while the user still authorises the wrong action.
Review the policy beside input handling, dependencies and the signing interface. Test that legitimate functions remain usable, and preserve the exact policy version when documenting a finding. A copied scanner grade alone cannot explain coverage. Continue with audit scope and same-origin policy.