2

What is the X-Webkit-CSP Security header in the browser ? What kind of attacks that we can mitigate from this ?

  • It's a legacy header for Content Security Policy from the times when it was still in early adoption phase. This header was used by Chrome for testing CSP. It's now almost completely abandoned - see webcookies.org/http-headers around 400 sites still use it as compared to over 10k for the standard CSP header. – kravietz Sep 18 '17 at 8:03
2

This is a deprecated HTTP header and it is being replaced by the Content Security Policy header. This will prevent prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.

All the X-* policy headers are non standard headers and following headers are also deprecated and replaced by the CSP.

X-Frame-Options

X-XSS-Protection

X-Content-Security-Policy

Ref : https://content-security-policy.com/

https://developers.google.com/web/fundamentals/security/csp/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.