While implementing CSP, there are two options.

  1. Implement CSP in the HTTP response header
  2. Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-src 'self'">

Out of the above two, which method is more secure and why? Why the other is less secure?


1 Answer 1


I would say using headers is marginally more secure than a meta tag because:

  1. Some CSP elements such as report-to/report-uri are not supported in meta tags (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to for that specific example and following the comment from Fire Quacker, this more general guidance https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#3-content-security-policy-meta-tag)
  2. Using headers allows a client to view the CSP via a HEAD request without loading the page. This could allow the client to decide not to proceed to a GET request if it did not like the CSP content (I appreciate this may be marginal security benefit, or maybe no real benefit at all in most cases)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .