title: nodeJS - where exactly can I put the Content Security Policy
body: <p>I don't know where to apply the Content Security Policy (CSP) snippet below in my code;</p>
  
  <pre><code>Content-Security-Policy: script-src 'self' https://apis.google.com
  </code></pre>
  
  <p>Should it be in the HTML?</p>
  
  <p>Will it be best implemented in JavaScript as in the code snippet below?</p>
  
  <pre><code>var policy = "default-src 'self'";
  http.createServer(function (req, res) {
      res.writeHead(200, {
          'Content-Security-Policy': policy
      });
  });
  </code></pre>