#xss

Security Headers

Content-Security-Policy for people who do not write CSPs

CSP is the strongest defense against cross-site scripting — and the most misunderstood header. Here is what it actually does, minus the jargon.