Content Security Policy (CSP)
Configure and enforce a robust Content Security Policy to mitigate injection attacks and control resource loading.
What is CSP?
Welcome to Content Security Policy (CSP)! This powerful security feature helps protect your browser extensions and web pages from dangerous attacks like Cross-Site Scripting (XSS).
Think of CSP as a bouncer for your extension. It tells the browser exactly which sources are allowed to load scripts, styles, images, and other resources.
How CSP Works
CSP operates by defining a set of "directives" in your extension's manifest.json file. Each directive specifies valid sources for a particular type of resource.
- Scripts: Where JavaScript can load from.
- Styles: Where CSS can come from.
- Images: Allowed sources for images.
- Frames: Which URLs can be embedded in iframes.
If a resource tries to load from an unapproved source, the browser blocks it!
All lessons in this course
- Understanding Advanced Permissions
- Secure Coding Practices
- Content Security Policy (CSP)
- Optional Permissions & Runtime Requests