Are you thinking of something else? Perhaps the same-origin policy, the thing that requires CORS if you need to do various cross-origin stuff? Because CSP is no

Are you thinking of something else? Perhaps the same-origin policy, the thing that requires CORS if you need to do various cross-origin stuff? Because CSP is not something there by default.