If the Content-Security-Policy header is present in the server response, a compliant client enforces a more strict execution mode for JavaScript in order to prevent certain cross-site scripting attacks.
A compliant client enforces a more strict execution mode for JavaScript. This is to prevent certain cross-site scripting attacks. The Content-Security-Policy header is present in the server response.