Content Security Policy

What?

Content Security Policy is an HTTP header. When interpreted by supporting browsers it allows us to restrict what our site loads, connects to, and executes.

Protects against a wide range of attacks, cross-site scripting and other cross-site injections.

How?

Send an HTTP header, for example:

Content-Security-Policy: default-src 'self';

Or:

Content-Security-Policy: default-src 'self' *.google-analytics.com;
                         style-src 'self' 'unsafe-inline';
                         frame-src 'self' https://*.youtube.com;

Benefits

• Prevents cross-site scripting - you specify the domains code can be executed from.
• Prevents code injection - you must allow inline script script-src: 'unsafe-inline';

Impact

This is a new Markdown slide

The future

This is a new Markdown slide

Other useful HTTP headers

This is a new Markdown slide

More reading

This is a new Markdown slide