Content Security Policy: limit what a page may execute

The allowed sources

Content Security Policy lets a site declare restrictions on resources and execution. A script policy can specify trusted sources and use nonces or hashes for intended scripts. Other directives govern objects, frames and additional resource types.

A policy's presence is not enough. Broad allowances can undermine the intended restriction, and report-only mode records potential violations without enforcing the same block. The deployed header is the relevant evidence.

What it cannot decide

CSP does not judge whether an allowed application asks for a harmful approval. If the application's own logic creates a misleading transaction request, the browser can faithfully enforce the policy while the user still authorises the wrong action.

Review the policy beside input handling, dependencies and the signing interface. Test that legitimate functions remain usable, and preserve the exact policy version when documenting a finding. A copied scanner grade alone cannot explain coverage. Continue with audit scope and same-origin policy.

Sources and originals

• MDN: Content Security Policy