Implement content security policy

---
name: implement-content-security-policy
category: web
description: Implement a staged Content Security Policy from an evidence-based resource inventory, with enforceable directives and safe rollout controls. Use when reducing script, framing, injection, or data-exfiltration risk in a web application.
---

# implement-content-security-policy

Build the policy from required behavior, not copied allowlists.

## When to use

- Use for a new policy, a report-only policy ready for enforcement, or a policy weakened by third-party additions.
- Fix injection flaws independently; CSP is defense in depth, not permission to render unsafe input.

## Procedure

1. Inventory first-party and third-party scripts, styles, images, fonts, frames, workers, forms, media, manifests, and network destinations by route and user state.
2. Remove obsolete dependencies and inline code before granting sources.
3. Establish `default-src 'none'`, then add the narrowest required directives for each resource class.
4. Prefer per-response nonces or stable hashes for required inline code. Do not add `unsafe-inline` or broad wildcards to silence violations.
5. Constrain navigation and embedding with `base-uri`, `object-src`, `frame-ancestors`, `form-action`, and relevant sandbox or permission controls.
6. Evaluate `strict-dynamic`, Trusted Types, upgrade controls, and reporting against browser support and application architecture.
7. Deploy report-only to controlled users. Sample and redact reports so URLs or user data do not become a new privacy leak.
8. Classify violations as required behavior, blocked attack, extension noise, browser variance, or application defect.
9. Add automated header, nonce, route, browser, third-party failure, and injection tests.
10. Enforce by route or traffic wave with violation, conversion, error, and support monitoring. Keep a versioned rollback that restores the last safe policy rather than removing CSP.

## Failure plan

- If a vendor needs a broad source, isolate or replace it before widening the whole application.
- If enforcement breaks a critical route, revert to the last safe policy while preserving report evidence and fixing the missing dependency.
- Never include secrets, full query strings, or personal data in violation telemetry.

## Done

- A CSP inventory maps every allowed source and directive to an owner and required behavior
- Browser and injection tests prove required resources work and unauthorized script, frame, form, and connection paths are blocked
- A staged enforcement record captures violations, exceptions, monitoring, policy version, and safe rollback