Question 1

What is Content Security Policy (CSP)?

Accepted Answer

CSP is an HTTP header that tells the browser which sources are allowed to load resources (scripts, styles, images, etc.). A properly configured CSP blocks XSS attacks and code injections.

Question 2

How does a nonce work in CSP?

Accepted Answer

A nonce is a random value generated on the server for each request. It is added to the CSP header and to the

Question 3

What is the difference between Report-Only and enforce mode?

Accepted Answer

Report-Only sends violation reports but does not block content. Enforce mode blocks resources that violate the policy. We recommend starting with Report-Only, collecting data, and then switching to enforce mode.

Question 4

What difficulties arise when setting up CSP for an SPA?

Accepted Answer

SPAs often use eval() or dynamic script loading via Webpack, which conflicts with strict CSP. Solutions include disabling eval-based source maps, using TrustedTypes, and whitelisting domains for analytics (GA, GTM).

Question 5

How can I monitor CSP violations?

Accepted Answer

You can set up an endpoint to collect CSP reports (e.g., /csp-report) or use services like Report URI or Sentry. Analyzing reports helps identify forgotten sources and real XSS attempts.

Question 6

How much does CSP setup cost?

Accepted Answer

Prices vary depending on site complexity. Typical projects range from $1,500 to $5,000. Turnkey solution includes audit, implementation, and monitoring. Contact us for a free estimate.

An Engineer's Guide to Content Security Policy Setup

Development and maintenance of all types of websites: