Content Security Policy

Content Security Policy (CSP) is an HTTP response header that instructs browsers which sources of content are permitted to load on a page. It mitigates cross-site scripting (XSS) and data injection attacks by restricting executable scripts, stylesheets, images, and other resources, and mitigates clickjacking through the frame-ancestors directive, which controls who may embed the page in a frame. CSP directives include script-src, style-src, img-src, and connect-src, each specifying allowed origins. Violations can be reported to a designated endpoint for monitoring. For URL shortening services, CSP implementation protects redirect landing pages and management dashboards from injection attacks. A policy applies to the document it is delivered with, so preview pages and interstitial warnings are governed by the shortener's own policy rather than the destination site's. The interaction to plan for runs the other way: if a preview page embeds the destination in a frame, that site's frame-ancestors directive can block it.