Content Security Policy (CSP) monitoring explained
What it is
Content-Security-Policy (CSP) is a response header that restricts where scripts, styles, images, and other resources can load from. It reduces the impact of XSS and data injection by blocking unauthorized sources.
Why it matters
Without CSP, a single XSS can load and run any script. CSP limits the damage. A well-configured CSP is a strong defense-in-depth measure. Monitoring catches missing or weak policies.
How Barrion checks it
Barrion inspects the Content-Security-Policy (and Report-Only) header. We check for presence, key directives (default-src, script-src, frame-ancestors), and dangerous values like 'unsafe-inline' or 'unsafe-eval' where they increase risk. Passive header check only.
