This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].
Content Security Policy is a HTTP header, designed to tell the browser what sources a website is allowed to request data from.
The following is an example of a Content Security Policy header:
script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https:; object-src 'none'; base-uri 'none'; report-uri https://csp.example.com;
The header consists of several directives, such as
style-src. Each of these directives defines where the corresponding content may be loaded from.
style-src 'self' means that stylesheets may only be loaded from the same origin as the main document.
img-src https: means that images can be included from anywhere, as long as the https schema is being used.
The Mozilla docs contain an in-depth article on the Content Security Policy header, its versions and its usage.