Definition
Content Security Policy, or CSP, is a web security standard that helps prevent certain types of attacks, such as cross-site scripting (XSS) and data injection. It works by instructing the browser on which sources of content (like scripts, stylesheets, and images) are allowed to load for a given webpage. Implementing CSP is crucial for developers and security professionals to mitigate risks and protect users from malicious code. For instance, a CSP might specify that JavaScript can only be loaded from the website's own domain, preventing an attacker from injecting a malicious script. A common point of confusion is mistaking CSP for a firewall, when in reality it is a browser-level security mechanism. You will encounter Content Security Policy in cybersecurity certifications like CompTIA Security+ and CySA+.