Content Security Policy (CSP) as an XSS Defence Layer
Content Security Policy (CSP) is an HTTP response header that tells the browser which sources of content are legitimate. Even if an XSS payload is injected into the page, a strict CSP can prevent the injected script from executing or exfiltrating data by blocking inline scripts, restricting script sources to approved CDNs and your own origin, and disallowing dangerous APIs like `eval()`. CSP is a second line of defence that limits the impact of XSS when encoding fails.
A strict CSP uses the `'nonce-{random}'` or `'hash-{algo}-{value}'` approach to allow only specific inline scripts while blocking all others. For each page request, the server generates a cryptographically random nonce, includes it in the CSP header and in `