Content-Security-Policy
Restricts what a browser page may load and run.
Response header (sent by servers) security
How it works
Mostly relevant to HTML. For pure JSON APIs, a restrictive policy such as default-src ’none’; frame-ancestors ’none’ is cheap defence in depth.
Example
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: W3C CSP3.
Related headers
Cross-Origin-Resource-Policy
Which origins may embed this resource.
Permissions-Policy
Which browser features a page may use.
Referrer-Policy
How much of the current URL browsers send as Referer.
Strict-Transport-Security
Tells browsers to use HTTPS only for this host.
X-Content-Type-Options
Stops browsers from guessing the content type.
X-Frame-Options
Whether the page may be shown in a frame.