Content Security Policy (CSP) Header

Content Security Policy (CSP) is a standard that allows developers to disable or restrict browser features and control which external resources — such as scripts, styles, and fonts — a web application is permitted to load. On SAP BTP, developers use CSP to strengthen frontend communication security by defining trusted sources and reducing exposure to attacks such as cross-site scripting. To make an SAPUI5 app CSP compliant, developers must ensure their code avoids inline scripts and other patterns that violate CSP directives, and administrators can manage CSP settings — including trusted sites — through dedicated SAP-provided configuration apps.