Content-Security-Policy (CSP)

Content-Security-Policy (CSP) is a browser security mechanism that limits which resources a web page may load or execute. It is primarily used to reduce risks such as cross-site scripting (XSS) by defining allowed sources for scripts, styles, frames, images, and other content.

CSP is delivered by a server as an HTTP response header, commonly using `Content-Security-Policy`. The policy contains directives such as `script-src`, `style-src`, `img-src`, and `frame-src`, each describing permitted sources for a resource type.

For example, `script-src 'self'` permits scripts from the same origin while disallowing scripts from other origins. A policy can also use nonces or hashes to permit specific inline scripts without allowing arbitrary inline JavaScript.

CSP is enforced by the browser, not by the Java backend itself. A Java application such as a Spring Boot service typically generates the response header, while the user's browser interprets and enforces the policy when rendering the response.

CSP can also provide reporting mechanisms. With reporting-related directives or endpoints, violations can be sent to a server so developers can discover unexpected resource loads and refine a policy.

CSP complements other security controls rather than replacing them. Preventing XSS still requires safe output encoding, input handling where appropriate, secure framework configuration, and careful treatment of untrusted data.

Key points

• CSP is enforced by browsers through an HTTP response policy.
• Directives such as `script-src` control permitted resource origins and execution mechanisms.
• A nonce or hash can allow selected inline scripts without broadly enabling inline JavaScript.
• CSP is especially useful as a defense-in-depth control against XSS.
• A Java backend commonly sets CSP through an HTTP response header.

Interview questions

What problem does Content-Security-Policy solve?

CSP lets a website tell the browser which sources of content are permitted. It can restrict scripts, styles, images, frames, and other resource types. A restrictive script policy can make many XSS injection techniques harder to exploit because unauthorized scripts are blocked by the browser. It is a defense-in-depth measure and does not replace secure coding practices.

What does `script-src 'self'` mean?

It tells the browser that scripts may be loaded from the document's own origin. Scripts from unrelated origins are not permitted by that directive. The exact behavior can also be affected by other CSP directives and CSP inheritance rules. It is generally much more restrictive than allowing arbitrary script sources.

How can CSP allow a specific inline script without allowing all inline scripts?

A CSP can use a cryptographic nonce or a hash to authorize particular inline scripts. With a nonce, the server generates an unpredictable value and places it in both the CSP and the corresponding script element. A hash-based policy instead identifies an exact script body by its cryptographic hash. These mechanisms are preferable to broadly enabling inline scripts with `unsafe-inline` when an application needs selected inline code.

How would you add CSP to a Java backend?

The backend should emit a `Content-Security-Policy` HTTP response header with a policy appropriate for the application. In a Spring-based application, this can commonly be configured through Spring Security's HTTP security configuration rather than manually constructing headers in every controller. The policy should start with the resources the application actually needs and become more restrictive where practical. Testing is important because an overly strict policy can block legitimate scripts, styles, or frames.

Why is CSP not a complete defense against XSS?

CSP is enforced by the browser and therefore depends on the policy being correctly designed and delivered. Weak policies can leave significant attack surface, and application vulnerabilities can still exist even when a policy is present. Secure output encoding, safe templating, input handling where appropriate, and careful management of untrusted data remain necessary. CSP should therefore be treated as an additional security boundary rather than the sole XSS defense.