In-Depth Content Security Policy (CSP) and Subresource Integrity (SRI)
A structured engineering guide on Content Security Policy and cryptographic SRI hashing to prevent XSS and third-party supply chain risks.
Integrating third-party libraries introduces potential supply-chain risks. CSP headers and Subresource Integrity form complementary browser-level defense lines.
1. CSP Principles
- Nonce- or hash-based policies prevent execution of unauthorized inline scripts.
- Restricting object-src and base-uri directives closes common script injection vectors.
2. Subresource Integrity (SRI)
SRI ensures that resources fetched from external origins match designated cryptographic hashes, halting execution if files have been modified unexpectedly.