Which mechanism prevents the browser from executing a script injected into a page via a malicious third-party source?

Question

Web Development — Hard

Which mechanism prevents the browser from executing a script injected into a page via a malicious third-party source?

Accepted Answer

CSP is an HTTP response header that allows site administrators to declare approved sources of content that browsers are allowed to load. It effectively mitigates XSS by restricting where scripts can be loaded from and preventing the execution of inline scripts. SRI (D) validates the integrity of a specific file, but CSP provides the overarching policy enforcement for the entire document.