Content Security Policy and security headers
Comes up in: Web fundamentals
This concept is being written. It gets the full five steps — explanation, predict, interview angle, practice with tests, and review cards. Here is exactly what it will cover, so you can study it elsewhere in the meantime.
What it covers
- CSP directives
- nonce- or hash-based strict CSP with
strict-dynamic - report-only mode
- HSTS
X-Content-Type-OptionsReferrer-PolicyPermissions-Policy- COOP/COEP/CORP
- clickjacking and
frame-ancestors
Words you will know
What you will practise
- roll out a strict CSP in report-only then enforce
Interview questions this answers
- What is a Content Security Policy? How would you roll one out?
- What is clickjacking?
- What security headers would you set on a new app?