A site sends directives that restrict categories such as scripts, images, connections and embedded frames. The browser checks activity against those rules rather than trusting every resource requested by the page.
A policy can reduce exposure when untrusted content reaches an application, but it does not replace safe input handling, authentication or isolation. Incorrect restrictions can also break legitimate features.
ELI5
Think of a content security policy as a guest list for a web page: the browser checks which outside resources are allowed to enter.
For example, a page may allow scripts from its own server while blocking an unexpected script from an unrelated website.
Does a policy make an app completely safe?
No. It is one protective layer and depends on appropriate rules and other security controls.
Can it block a legitimate feature?
Yes. A resource or connection outside the permitted set can be blocked even when the application needs it.
