# Content Security Policy for Single Page Web Apps

DevFeed: [Content Security Policy for Single Page Web Apps](<https://devfeed.tech/articles/content-security-policy-for-single-page-web-apps-15586.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/content-security-policy-for-single-page-web-apps>)

Author: Square Engineering

Published: 2016-05-19T16:11:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Web app](<https://devfeed.tech/topics/webapp.md>), [Security](<https://devfeed.tech/topics/security.md>), [Web Development](<https://devfeed.tech/topics/web-development.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Web](<https://devfeed.tech/topics/web.md>)

Tags: [bootstrapping](<https://devfeed.tech/tags/bootstrapping.md>), [csp](<https://devfeed.tech/tags/csp.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>), [web-apps](<https://devfeed.tech/tags/web-apps.md>)

## AI overview

This tutorial explains how Square Cash implemented Content Security Policy on cash.me, including an iterative deployment process for identifying allowed sources and reducing policy violations. It describes how CSP restricts resource loading and connections, blocks inline scripts, helps mitigate some cross-site scripting and browser-based threats, and reports violations.

## Source excerpt

Deploying comprehensive CSP that supports template bootstrapping.