Difference between revisions of "Content Security Policy"
From MgmtWiki
(→References) |
m (→Problems) |
||
| Line 6: | Line 6: | ||
==Problems== | ==Problems== | ||
| − | Cross-site scripting (XSS) attacks, for example, bypass the | + | Cross-site scripting (XSS) attacks, for example, bypass the [[Same Origin Policy]] by tricking a site into delivering malicious code along with the intended content. This is a huge problem, as browsers trust all of the code that shows up on a page as being legitimately part of that page’s security origin. |
==Solutions== | ==Solutions== | ||
Latest revision as of 11:00, 21 November 2025
Full Title or Meme
Content Security Policy is a mechanism designed to make applications more secure against common web vulnerabilities, particularly cross-site scripting. It is enabled by setting the Content-Security-Policy HTTP response header.
Context
- As a part of having a Trusted Identity in Cyberspace a series of Framework Profiles have been created to allow digital Entities to give users a statement about the policies that they support.
Problems
Cross-site scripting (XSS) attacks, for example, bypass the Same Origin Policy by tricking a site into delivering malicious code along with the intended content. This is a huge problem, as browsers trust all of the code that shows up on a page as being legitimately part of that page’s security origin.
Solutions
References
- On "with google" Content Security Policy
- OWASP presentations So we broke all CSPs and what happened next.
- Trusted Location
