What is the primary purpose of the ‘Content-Security-Policy’ (CSP) ‘script-src’ directive?

Question

Web Development — Hard

What is the primary purpose of the ‘Content-Security-Policy’ (CSP) ‘script-src’ directive?

Accepted Answer

The 'script-src' directive is a core component of CSP used to define valid sources for JavaScript. By specifying allowed domains or using hashes/nonces, developers can prevent the execution of unauthorized or malicious scripts (e.g., XSS attacks). It does not handle encryption or caching, which are managed by other headers like TLS or Cache-Control.