FrontendHaltSecurity·Advanced·Conceptual·1 min read
Can a CSP be set with a meta tag instead of a header?
Short interview answer
Most directives can, which is useful when you don't control response headers, but some — notably frame-ancestors, sandbox, and report-uri — only work as a real header. A header is also applied earlier, before any markup is parsed.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.