This extension is part of the Rack::Protection project. Run gem install rack-protection to have it available.

Prevented attack

XSS and others

Supported browsers

Firefox 23+, Safari 7+, Chrome 25+, Opera 15+


Content Security Policy, a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). Content Security Policy is a declarative policy that lets the authors (or server administrators) of a web application inform the client about the sources from which the application expects to load resources.

More info

W3C CSP Level 1 : (deprecated) W3C CSP Level 2 : (current) W3C CSP Level 3 : (draft)


Sets the 'Content-Security-Policy' header.

Options: ContentSecurityPolicy configuration is a complex topic with

several levels of support that has evolved over time.
See the W3C documentation and the links in the more info
section for CSP usage examples and best practices. The
CSP3 directives in the 'NO_ARG_DIRECTIVES' constant need to be
presented in the options hash with a boolean 'true' in order
to be used in a policy.