Content-Security-Policy
Content Security Policy is a web security standard that lets a site specify browser-enforced rules restricting the sources and forms of content a document may load or execute.
Building Web APIs with ASP.NET Core
A content security policy is a browser-enforced security policy that restricts the sources and forms of content a web page may load or execute.
- How it is used
- Protects a deployed web API by restricting content browsers load or execute.
- How deep it goes
- Shows middleware configuration and a nonce-based exception, but defers detailed treatment of security-header settings.
- Examples
- Tests a deployed /cod/test endpoint, inspects a browser-console violation, and updates the policy and script with a matching nonce.
- What you can do after
- Operate/configure it in ASP.NET Core middleware and diagnose a blocked inline script with the browser console.
Read how Building Web APIs with ASP.NET Core explains Content-Security-Policy →
Grokking Web Application Security
A content security policy is a web security standard that specifies permitted sources and execution rules for resources loaded by a web page.
- How it is used
- Limits permitted resource loading and framing to reduce XSS and clickjacking risk.
- How deep it goes
- Explains header and meta delivery, source directives, inline-script tradeoffs, and framing rules without browser internals.
- Examples
- Uses Express and meta-tag policies, an injected comment script, and frame-ancestors policy variants.
- What you can do after
- Apply it via HTTP headers or meta tags to restrict resources, block inline scripts, and control framing.
Read how Grokking Web Application Security explains Content-Security-Policy →
Related concepts
- cross-site scripting attackaddresses · Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.
- JavaScriptconfigures · JavaScript is a high-level, dynamically typed, multi-paradigm programming language standardized as ECMAScript and used for web and general-purpose programming.
- principle of least privilegeused by · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
- nonceconfigured by · A nonce is a value intended for one-time use within a specified cryptographic, authentication, or authorization context.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.