FrontendHaltSecurity·Advanced·Conceptual·1 min read
How can CSP connect-src limit the damage of a compromised script?
Short interview answer
Even if a malicious script runs, connect-src restricts which origins it can send network requests to, so it can't easily exfiltrate data to an attacker-controlled server. It's a containment layer for the case where prevention failed.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.