The Content-Security-Policy (CSP) is an HTTP header that tells the browser which sources of scripts, styles, images, and other resources are allowed. It limits the impact of an XSS flaw by blocking unexpected scripts, and complements escaping without replacing it.
Example
Content-Security-Policy: default-src 'self'; script-src 'self'