Security·Intermediate·Conceptual·1 min read

Is Content Security Policy a fix for XSS?

Short interview answer

No. Output encoding and safe rendering APIs prevent XSS; CSP is defense-in-depth that limits the damage if an injection sink is missed. A strong CSP can reduce a critical XSS to negligible impact by ensuring the injected script simply doesn't execute.

Key takeaway

Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.

← Back to Content Security Policy and security headers

Is Content Security Policy a fix for XSS?

Key takeaway

Related questions