How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers?
Is it possible to circumvent CSP in order to execute XSS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, CSP goes a long way to defending against XSS. If you do a Google search on "Content Security Policy XSS" the first few links explain how and why.
If you're having trouble using Google, here are some good links to help explain how CSP defends against XSS:
Using Content Security Policy to Prevent Cross-Site Scripting (XSS) - SendSafely.com explains how they use CSP on their site.
The CSP policy is enforced by the browser. Therefore, assuming you have set a proper CSP policy, and assuming your browser doesn't have bugs, there is no way to bypass CSP. That's one of the attractions of CSP.
Note that some browsers (e.g., IE10 and earlier versions of IE, if I recall correctly) don't support CSP.
Be warned that CSP is not a silver bullet:
CSP stops most forms of script injection, but it does not stop markup injection: see, e.g., Postcards from the post-XSS world as well as the HTML form injection attack from Section III-A of Self-Exfiltration: The Dangers of Browser-Enforced Information Flow Control (Chen et al, W2SP 2012). So, you still will want to avoid introducing injection bugs into your code.
See also A few things beyond the scope of Content Security Policy for more discussion of some problems that CSP doesn't solve.