Cluster C3: Network & Security
CSP mistakes that break production
Content Security Policy is essential for reducing XSS risk, but a strict policy shipped without staged validation can block critical scripts and integrations. The safest path is to iterate from report-only into enforced rules with clear monitoring.
Common high-impact CSP mistakes
- Blocking required inline scripts without nonce/hash migration.
- Forgetting third-party domains for auth, analytics, or payment flows.
- Using wildcard sources in production and assuming equivalent security.
- Skipping report pipeline analysis before enforcing a strict policy.
Practical input/output example
Input policy
script-src 'self'; connect-src 'self';
Output behavior
payment SDK blocked auth callback blocked