Using a content security policy

CORS is an example of a set of request headers that were introduced to address malicious behavior by providing the browser with information about how the application is expected to work.

There are additional headers that the backend server can set to provide the browser with insight into how the application works and what behaviors are expected. The most important header is Content-Security-Policy, which the backend server uses to describe the application’s Content Security Policy (CSP). The CSP tells the browser what behaviors to expect from the client-side application so that the browser can block suspicious activity.

The use of content security policies is intended to prevent cross-site scripting (XSS) attacks. There are many variations of XSS attacks, but they all involve injecting malicious content or code into the content displayed by the browser to perform a task not intended by the application developers – typically something...