Web Vulnerabilities
Content Security Policy
Also: CSP
A response header that tells the browser which sources of script, images and frames a page may use.
In more detail
CSP is a second layer for cross-site scripting: even if an injected script tag slips in, a strict policy can stop the browser from running it. It does not fix the underlying bug, so it is used together with output encoding, not instead of it.