title: flask CSP ( Content-Security-Policy ) best practice against attack such as cross site scripting
body: <p>I am new to CSP. I am trying to implement CSP in all my templates in my flask app by setting the resp_header to protect my website from Cross-Site Scripting attacks. I modified my render template from:</p>
  <pre><code>return render_template('addvideos.html'  form=form, legend = 'Update video : '+ videos.video_name)
  </code></pre>
  <p>to</p>
  <pre><code>    resp = make_response(render_template('addvideos.html', legend = 'Update video : '+ videos.video_name)
  )
      resp.headers['Content-Security-Policy'] = &quot;default-src 'self';&quot;
      return resp
  </code></pre>
  <p>I have more than 50 &quot;render_template&quot; in the app and I will have to add a response header for each. After research, I found out that after_request will do the trick as shown below:</p>
  <pre><code>@app.after_request
  def add_security_headers(resp):
      resp.headers['Content-Security-Policy']='default-src \'self\''
      return resp
  </code></pre>
  <p>is this very reliable? What if I apply the CSP directly in the HTML template ( jinja2 ), is that possible? Which is more reliable?</p>