Content Security Policy (CSP) & CORS Header Studio

Content Security Policy (CSP) is an HTTP response header that instructs modern browsers which dynamic resources are allowed to load and execute. By defining strict source whitelists, CSP prevents Cross-Site Scripting (XSS), data injection, and malicious payload execution even if an application has underlying HTML injection vulnerabilities.

The legacy `X-Frame-Options: DENY` header has been superseded by the CSP `frame-ancestors` directive. Setting `frame-ancestors 'none';` ensures that your web application cannot be embedded in malicious iframes on third-party domains, entirely defeating UI redress (clickjacking) attacks.

CORS is a browser security mechanism that relaxes the Same-Origin Policy (SOP) for designated cross-origin HTTP requests. When an application on https://app.example.com makes an asynchronous fetch() request to https://api.example.com, the server must respond with `Access-Control-Allow-Origin` and preflight headers (`OPTIONS`) approving the transaction.

Browser security specifications explicitly prohibit setting `Access-Control-Allow-Credentials: true` when `Access-Control-Allow-Origin: *`. When credentials (cookies or Authorization headers) are allowed, the server must reflect the exact verified requesting origin instead of a wildcard.

Rather than relying on permissive 'unsafe-inline' rules, modern high-security web apps generate a cryptographic nonce (random token) on the server per request and include it in both the CSP header (`script-src 'nonce-xyz'`) and the HTML `<script nonce="xyz">` tag.