Strict CSP contains injected scripts by default

An attacker hides a script inside a comment field, and every visitor silently runs it.

I treat strict Content Security Policy as the containment layer that stops injected scripts from executing.

MDN requires the policy in a response header on every response, written as semicolon separated directives.

Strict policies use a fresh nonce or hash per response instead of broad origin lists attackers can abuse.

If Parameterized queries separate data from commands guards the server, then Secure cookies still need explicit CSRF defense guards the session it issues.

I ship nonce based CSP knowing it layers over validation rather than replacing it.