Add CSP headers to prevent XSS and injection attacks
Implement Content Security Policy for {{APPLICATION}}:
Current issues:
{{CSP_ISSUES}}
CSP directives to configure:
1. default-src: Where resources can load from
2. script-src: Allowed JavaScript sources
3. style-src: Allowed CSS sources
4. img-src: Allowed image sources
5. font-src: Allowed font sources
6. connect-src: Allowed API endpoints
7. frame-src: Allowed iframes
8. Report-uri: Violation reporting
Provide:
- CSP header configuration
- Report-only mode for testing
- Violation reporting endpoint
- Test script to verify CSP works
- Migration plan from no-CSP
- Common CSP issues and fixesAdding security headers to web apps