Content Security Policy (CSP) missing — what it is and how to add one safely

Real-world risk

Without CSP, injected script runs with fewer browser-enforced limits; XSS impact is often worse.

Fix steps (in order)

1. Add Content-Security-Policy (start with report-only if needed): Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'
2. Tighten script-src over time; avoid unsafe-inline in production where possible.

Example configurations

Patterns for common stacks. Set headers at your CDN, load balancer, or origin as appropriate.

• nginx · nginx

  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'" always;

• Express (helmet) · typescript

  import helmet from "helmet";
  app.use(
    helmet.contentSecurityPolicy({
      directives: {
        defaultSrc: ["'self'"],
        baseUri: ["'self'"],
        formAction: ["'self'"],
      },
    }),
  );

• Apache · apache

  Header set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'"