Lesson 3 of 11 · 18 min read
Content Security Policy in Depth
A Content Security Policy is a response header the browser enforces for one document: it decides which scripts, styles, frames and connections the page may use, blocks the rest and can report violations. Host allowlists failed in practice because allowed domains host code an attacker can reuse. A strict policy trusts scripts by per-response nonce or by hash, propagates trust with strict-dynamic, and adds object-src and base-uri. Trusted Types closes DOM sinks. CSP limits XSS impact; it does not fix XSS or stop data leaving.
free sign-in, no card required
Practise it as an interviewer asks it
What happens, security-wise, from typing a URL to seeing the page? Name the attack and the defence at each step.What do SQL injection, command injection and template injection have in common, and why does parameterisation fix SQL injection?How must model output be handled before it reaches a browser, SQL engine, shell or other interpreter?How is securing an LLM application different from ordinary application security, and what stays exactly the same?Explain XSS and how contextual output encoding and CSP prevent it.How can an assistant that only outputs text still leak data through images, links and previews?