CSP
Content Security Policy (CSP) (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.
A proper CSP setup in your application can handle content injection vulnerabilities, and is a great way to reduce XSS. XSS stands at number two in the OWASP Top 10.
A CSP is not a solution to handling all injection vulnerabilities, but can be used as one of the tools to reduce injection attacks to a reasonable level.
CSP is a declarative policy, implemented using HTTP headers. It can be run in an application in two modes:
- Production mode (declared as CSP)
- Report-only mode (used for testing and are declared as Content-Security-Policy-Report-Only)
CSP contains a set of security policy directives responsible for putting appropriate restrictions on a web resource...
