Content Security Policy (CSP)
Content Security Policy (CSP) is an HTTP response header that tells browsers which sources of scripts, styles, images, and network connections a page is allowed to use. By blocking unapproved sources, CSP reduces the impact of cross-site scripting and data exfiltration.
Technical Architecture & Deep-Dive
A policy such as `connect-src https://api.myapp.com` limits fetch and XHR requests to approved API domains. If an attacker injects a script, it cannot easily send stolen data elsewhere.
Routing all third-party API calls through a single edge gateway simplifies CSP: instead of allowlisting many provider domains, the policy can permit one gateway origin.
Key Architectural Benefits
Implement Content Security Policy (CSP) at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Can CSP break my site?
Yes, if legitimate sources are missing. Start with Content-Security-Policy-Report-Only to collect violations before enforcing.
Related Architecture Concepts
Allowed origins are a configured list of website domains permitted to call an API from a browser. The server or gateway checks the Origin header of each request and only returns CORS permission headers, or accepts the request, when the origin is on the allowlist.
Cross-Origin Resource Sharing (CORS) is a browser security protocol that restricts web applications from making API requests to a different domain unless the server explicitly grants permission via HTTP headers. Edge proxies resolve CORS errors by terminating browser preflight OPTIONS requests directly at the edge.
A Web Application Firewall (WAF) is a security layer that inspects HTTP requests and blocks malicious traffic such as SQL injection, cross-site scripting, and known exploit patterns. It sits in front of web applications and APIs, filtering attacks before they reach origin servers.