CSP
CSP (Content Security Policy)
A browser security standard that allows website owners to specify which sources of content (scripts, styles, images, fonts) are permitted to load, providing a strong defense against cross-site scripting (XSS) and data injection attacks.
技術的詳細
CSP is delivered via the Content-Security-Policy HTTP header or a tag. Directives include default-src (fallback), script-src (JavaScript sources), style-src (CSS), img-src (images), connect-src (fetch/XHR), font-src, and frame-src. Values can be 'self' (same origin), specific domains, 'unsafe-inline' (not recommended), 'nonce-{random}', or 'sha256-{hash}'. The report-uri/report-to directives send violation reports to a specified endpoint. Strict CSP policies effectively eliminate inline XSS by requiring all scripts to have nonces or hashes.
例
```javascript
// CSP: web API example
const response = await fetch('/api/resource');
const data = await response.json();
console.log(data);
```