I would like to know how really good is the content security policy header for preventing XSS considering the following :
- Many sites have inline JS / CSS.
- The request/ response headers can be modified in Transit.
You have to get rid of the inline JS in order to be able to set a useful policy. (You can include
unsafe-inline in the policy, but at that point you're disabling the main point of using it.) Deploying CSP in any useful way means you're probably going to have to update your app to remove any inline script and style, but this is a 'best practices' measure with other advantages than just CSP.
Yes, if you have a man-in-the-middle attack then you've lost worse already. If that's on your threat model you should be addressing it with SSL.
CSP should not be used as a primary defence against XSS - you still need to be doing HTML-escaping and all the other measures to make your app secure and correct. But it's a good defence-in-depth measure to make exploitation of an accidental lapse in that less likely.