CSP
InformationalContent Security Policy
Definition
Content Security Policy (CSP) is a security mechanism implemented through an HTTP header that lets websites control which resources (scripts, styles, images, etc.) the browser may load. CSP is the primary defense against XSS, since it can block the execution of inline scripts and restrict the allowed script sources.
Impact
Primary mitigation against XSS attacksGranular control of the allowed resource sourcesPrevents loading scripts from unauthorized domainsViolation reports to detect attack attemptsA CSP bypass can amplify the impact of other vulnerabilities
Examples
CSP example and common bypasses
A well-configured CSP uses nonces or hashes to allow only specific scripts. A weak CSP with 'unsafe-inline' or one that includes domains with JSONP endpoints can be bypassed, nullifying the protection against XSS.
# Strict CSP (good) Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123' # Weak CSP (vulnerable to bypass) Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' # CSP with a JSONP bypass Content-Security-Policy: script-src 'self' https://accounts.google.com # Bypass using Google's JSONP endpoint: <script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"></script>