Content Security Policy

Content Security Policy (CSP) is a security mechanism. It helps prevent cross-site scripting (XSS), clickjacking, and other code-injection attacks. CSP controls which resources a Web page can load and run.

SparkleMuffin uses CSP headers to restrict inline scripts, styles, and external resources to trusted sources. This makes the application more secure.

Specifications and Resources

• Wikipedia - Content Security Policy
• MDN - Content-Security-Policy header reference
• web.dev - Content Security Policy
• web.dev - Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)
• Google - CSP Evaluator - tool to evaluate CSP policies
• OWASP - Content Security Policy Cheat Sheet