Content Security Policy

An attacker manages to inject JavaScript into your page. If the browser executes arbitrary injected scripts, the attacker can act inside your application.

The server tells the browser which sources of scripts and other resources are permitted. CORS controls which website origins may read an API's responses—for example, api.example.com allows JavaScript on shop.example.com to read them. CSP controls which scripts, images, and connections a page may use—for example, the shop allows scripts only from its own domain, helping block injected scripts. Both use HTTP response headers and browser enforcement, but control different permissions.