Implement Content Security Policy
Craft a strict CSP in report-only mode, tighten it based on real violations, then switch to enforcing. Includes a nonce-based approach for inline scripts.
Preview
Copy prompt
Write and progressively harden a Content Security Policy for a [Framework] web app that loads resources from [CDN, third-party scripts, inline styles, or embedded iframes]. Start by deploying the CSP in report-only mode using a report-uri endpoint to collect real violations without breaking anything. Analyse the violation reports to identify legitimate resource sources. Iteratively tighten the policy to block all unlisted sources. Finally switch to enforcing mode and implement a nonce-based approach to allow specific inline scripts without using unsafe-inline.
More
Security
Prompts
