Tobago supports Content Security Policy (CSP) to prevent cross-site
scripting (XSS) and related attacks.
Specification link.
In short: The HTML page doesn't contain any JavaScript or CSS information.
All allowed sources for JavaScript, CSS and other resources have to be declared in special header.
If you have own renderers or own JavaScript in your application, this code also needs to support CSP, to use this feature.
Please define CSP in the tobago-config.xml file.
Notice:
When you can read this text, it hasn't been manipulated by JavaScript. That means the CSP is working correctly.
Attention!
When you can read this text, the content was manipulated by JavaScript. It seems, your browser doesn't support CSP!