CSP Builder
Create a Content Security Policy for your application.
How to think about web security
CSP Builder helps review controls, but it cannot promise security by itself. Policies and signatures work only when enforced on the server and paired with a threat model.
- Follow least privilege: allow only the origins, resources, algorithms, and permissions that are required.
- Distinguish encoding, integrity, authentication, and confidentiality; they solve different problems.
- Validate again on the backend and avoid putting sensitive data in URLs, logs, or diagnostic messages.
Practical tip: Use fictional values and obtain specialist review before deploying a cryptographic policy.