Security
Content Security Policy Level 3
The deployable CSP today. script-src, object-src, and base-uri are the three controls that actually stop XSS — the rest is optional.
What it is
Content Security Policy Level 3 — a Working Draft from the W3C Web Application Security Working Group. Defines a header that lets a site declare which sources the browser may fetch or execute. Strict CSP (nonces or hashes plus 'strict-dynamic') is the modern XSS mitigation pattern.
Why it matters
A correctly-configured CSP turns most XSS findings from 'critical' into 'no impact'. Wrong CSP — wildcards, 'unsafe-inline', no script-src — provides false comfort with no actual protection.
Who it applies to
Every site rendering HTML — defense-in-depth against script injection.
How WQI scores it
Web Quality Index considers this standard satisfied when the supporting factor passes.
| # | Factor | Status |
|---|---|---|
| 4 | Security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options) | live |
Related standards
- See also
- Security headers , SRI , XFO , Permissions-Policy
Standards that share factors with this one
Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.
Other references
- guidance MDN — Content-Security-Policy
- tooling Google CSP Evaluator
- guidance OWASP CSP Cheat Sheet
- guidance web.dev — Strict CSP
Examples
Content-Security-Policy: default-src 'self'; script-src 'nonce-r4nd0m' 'strict-dynamic' https: 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; require-trusted-types-for 'script'; report-uri https://example.com/csp-reports'nonce-…' authorises the inline scripts you intend; 'strict-dynamic' propagates trust to scripts they load. The 'https:' and 'unsafe-inline' fallbacks are ignored by browsers that understand 'strict-dynamic' — they keep older browsers usable.
<script nonce="r4nd0m" src="/static/app.js"></script>Generate a fresh nonce per response, server-side. Never reuse one.
Implementation guidance
- Cloudflare Cloudflare — set CSP via Transform Rules
- Generic web.dev — Mitigate XSS with Strict CSP
- Generic MDN — CSP guide