What is a Content Security Policy (CSP)?

Content Security Policy (CSP)

A Content Security Policy (CSP) is a response header that tells the browser from which sources a page may load scripts, stylesheets, images and frames.

daniele@mikweb: ~/glossary — man content-security-policy

A CSP consists of directives such as default-src, script-src, img-src or frame-ancestors. Anything not allowed is blocked by the browser and reported in the console. This greatly limits the impact of cross-site scripting.

With Content-Security-Policy-Report-Only you can test a policy without blocking anything, and see in advance which embedded services (analytics, fonts, maps) are still missing.

In practice CSP headers often clash between application and reverse proxy: Nextcloud sends its own CSP, and an extra header added in the proxy means two policies apply and both must be satisfied. Pages then stay blank or viewers fail to load.

Example

Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'