Documentation / Platform glossary / Content Security Policy
Content Security Policy is a browser security standard that lets a site declare which sources of script, style, images, and other resources are permitted to load. The browser enforces the declaration, so injected content from an unapproved origin does not execute.
A site sends a Content-Security-Policy response header listing directives, each naming the origins allowed for a class of resource. script-src governs JavaScript, style-src stylesheets, img-src images, connect-src outbound requests, and frame-ancestors who may embed the page. default-src supplies a fallback for directives not stated.
CSP is a defence in depth control, not a fix for injection. Its value is that when an injection flaw exists — and in a large application the realistic assumption is that one eventually will — the attacker's payload is blocked at execution because it comes from an origin the policy does not allow.
Policy strength depends almost entirely on how inline script is handled. A policy permitting 'unsafe-inline' for scripts provides very little protection, because injected inline script is exactly the common case. The stronger approach is a per-response nonce or a hash, so only script the server explicitly marked runs.
CSP also supports report-only mode, which reports violations without blocking. That is how a policy is introduced safely on an existing application: observe what a candidate policy would have broken before enforcing it.
Cross-site scripting remains one of the most consequential web vulnerabilities, and on a page handling workforce data an executed payload can read whatever the signed-in user can. CSP limits that by constraining execution rather than relying on every input path being correct.
The usual failure is a policy weakened until it stops breaking things — 'unsafe-inline' added, wildcards broadened — at which point it satisfies a scan without providing protection.
QueryTek applies Content Security Policy on its public and product surfaces as one layer alongside input validation and output encoding. Specific directive values are treated as configuration detail and are not published.
