Content Security Policy for React Apps

Content Security Policy (CSP) is an HTTP response header that tells the browser which content sources are trusted. By declaring exactly which scripts, styles, images, and fonts are allowed to load, CSP prevents injected malicious content from executing — even if an XSS vulnerability allows the attacker to inject HTML into the page.

default-src 'self' sets the baseline: all resource types (scripts, styles, images, fonts, frames) may only load from the same origin. script-src 'self' narrows script loading to the same origin, blocking scripts from external CDNs unless explicitly listed. These two directives together form the foundation of a restrictive CSP.