Content Security Policy is a browser security mechanism that helps prevent various types of attacks, including Cross-Site Scripting (XSS) and other code injection attacks. CSP works by specifying which content sources the browser should consider valid, controlling everything from script execution to image loading. It provides granular control over resource loading and helps maintain a strict security boundary around web applications.
A Content Security Policy is an HTTP response header, or meta tag, that tells the browser which sources of scripts, styles, images, and other resources are allowed to load on a page. By declaring an allow-list, a CSP can block inline scripts and untrusted domains, which limits the impact of cross-site scripting and unauthorised resource loading. It is a browser-enforced defence-in-depth control, not a standalone security product.
A CSP governs where scripts may load from, not what they do once loaded. If you allow-list a third-party vendor and that vendor is compromised, the browser still trusts and runs the malicious script. CSPs are also hard to maintain: unsafe-inline, broad wildcards, and long allow-lists creep in to avoid breaking functionality, quietly eroding the protection, and report-only mode plus alert fatigue means violations often go unwatched.
cside addresses exactly the gap a CSP leaves: it inspects the behaviour of the allow-listed scripts a CSP permits. When a trusted script starts reading card fields or contacting a new domain, cside flags and can block it, regardless of the CSP verdict. Used together, a CSP narrows which scripts can load and cside verifies that the ones that do load stay honest.
No. A CSP restricts script sources but cannot tell whether an allow-listed script has been tampered with. PCI DSS 6.4.3 and 11.6.1 expect you to both manage which scripts run and monitor their integrity and behaviour; the second half is what a CSP does not provide.
Weakening the policy to avoid breakage, adding unsafe-inline, wildcard sources, or a long list of third-party domains, until it no longer meaningfully restricts anything. A permissive CSP can give a false sense of security while allowing most of what it was meant to block.
We answer client-side security questions every day. Bring yours.