Browser security policies
The browser can enforce boundaries that remain active after the page is delivered.
How HTTP headers constrain content, framing, permissions and unexpected interpretations in the browser.
Content Security Policy
Content Security Policy defines allowed sources for each resource type and can prevent execution outside that policy. It reduces the impact of some flaws by limiting what the browser accepts and runs.
CSP is an additional layer, not a fix for vulnerable code. A broad policy loses effect; a strict policy written without knowing the resources of the page blocks legitimate features.
Framing and deceptive interfaces
A page loaded in a frame controlled by another website can induce clicks outside their intended context. Restricting who may frame the content reduces this type of deceptive interface.
The frame-ancestors directive and X-Frame-Options header address this boundary. The choice follows the product's actual embedding needs.
Types, permissions and referrers
X-Content-Type-Options tells the browser to respect the declared type. Permissions-Policy can restrict capabilities such as camera, microphone and geolocation when the page does not need them.
Referrer-Policy controls how much information follows a navigation to another site. Application, server and edge have to declare the same value: a repeated header with different content is a common source of unexpected behavior.