I’m trying to better understand Content Security Policies. My understanding is that they are an instruction to the browser of where certain parts of the page are allowed to be loaded from – images, media, scripts etc.

But I can’t figure out why a server whose purpose is to respond to requests for data – JSON for example – would need a CSP. It only provides data for other parties to consume. There is no browser involved.

So why would a REST API need a CSP? Is my understanding in the first paragraph incorrect?