What is CSP Directives?
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
Related terms
Content Security Policy
An HTTP response header that whitelists exactly which origins may supply scripts, styles, and frames. A tight policy neuters injected payloads even after an XSS bug ships.
Cross-Site Scripting (XSS)
An injection flaw where attacker-supplied scripts execute in a victim’s browser, stealing sessions or defacing pages. Output-encoding, framework auto-escaping, and strong CSP turn most payloads inert.
Mixed Content
HTTP resources loaded on an HTTPS page. Browsers block or warn on them, breaking assets and trust signals, so audits must catch a single insecure canonical, script, or image.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.