Frontend & browser·Browser security
an injected script was blocked because the browser refused to run anything from an origin not on the list.
Content Security Policy
Also calledCSP
A response header declaring which sources of script, style, image and connection the page may use, enforced by the browser. It is a second line of defence: it does not prevent injection, it prevents the injected thing from doing anything useful. Rolling one out realistically means starting in report-only mode, because inline scripts, inline event handlers and `eval` in dependencies all break under a strict policy.