FrontendHaltSecurity·Intermediate·Conceptual·1 min read
What does a Content Security Policy provide?
Short interview answer
CSP restricts which scripts and other resources a document may execute or load. A strict nonce- or hash-based script policy reduces the impact of injection, while report-only deployment helps discover violations. CSP is defense in depth, not permission to keep unsafe rendering.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.