I've been reviewing CSRF and Content Security Policy guidance and noticed that many important protections are still opt-in. Often, newer security features are added to patch weaknesses in older web standards, but existing sites remain compatible with the old behavior.
That made sense when web development moved more slowly, but AI is now making it much faster to write and update software. Given the growing cybersecurity risks, why can't browsers gradually require more secure defaults? For example, browsers could eventually use something like `Content-Security-Policy: default-src 'none'` unless a site explicitly opts into the resources it needs.
A change like that would obviously break many sites, but a rollout over several years seems potentially manageable. The shift toward HTTPS was a major change too, so why couldn't browsers take a similar approach with other security standards?
3 Answers
The main obstacle is backward compatibility, not the speed of writing new code. A strict default CSP would immediately break a huge number of existing sites, including old systems that people still rely on. The browser that enforced it first would be blamed for making those sites unusable, while users could simply switch to a browser that still allowed them.
HTTPS was not introduced by browsers suddenly blocking every HTTP site. Certificates became much easier to obtain, and browsers increasingly warned users about insecure connections while developers migrated their sites. That was disruptive, but it still left a path for old sites to keep working.
A multi-year rollout could make a change less painful, but it would still need a practical migration plan. Browsers would have to identify affected sites, provide useful diagnostics, offer temporary exceptions, and persuade owners to update their code. If one browser became strict before the others, users would probably move to the less restrictive option.
Security defaults are worthwhile, but they work best when browsers can provide a compatible alternative or when the site owner is clearly responsible for making the change. Otherwise the browser ends up being blamed for breaking the web.
Browsers already enforce some secure defaults, such as the same-origin policy, with mechanisms like CORS available when applications genuinely need cross-origin access. The general direction has been toward stronger defaults, but each change has to account for compatibility and the consequences of breaking legitimate functionality.
A strict CSP is especially difficult because websites depend on many different scripts, styles, images, third-party services, and dynamic behaviors. The browser cannot reliably infer which of those are intentional, so the site developer has to declare the policy.
AI might reduce the effort needed to update individual applications, but it doesn’t solve the coordination problem. Site owners, vendors, organizations, and browser makers would all need to agree on a timeline, and many abandoned or poorly maintained sites could never be updated.