Understanding the CSP Header

A CSP header is structured into directives that specify which sources are allowed for different types of resources.

A Content Security Policy (CSP) header consists of the following:

• default-src 'self' - This directive restricts all default resource loading (scripts, styles, fonts, etc.) to the same origin as your application.

• #APEX_CSP_NONCE# - APEX dynamically replaces this placeholder with a cryptographically secure nonce for each request. This allows inline scripts that include this nonce to execute, while blocking others.

• object-src 'none' - Disallows the use of <object>, <embed>, and <applet> elements, which are commonly exploited.

• img-src 'self' data: - Allows images from the same origin and inline images encoded in data: URLs.