Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
28
votes
2answers
11k views

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
5
votes
3answers
330 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
2
votes
2answers
1k views

Why are inline scripts and styles considered not secure under content security policy?

Inline scripts and styles are just a kind of language (CSS/Javascript) embedded in another langauge (HTML). Why are them not allowed by default under content security policy?
28
votes
2answers
11k views

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%...
8
votes
1answer
607 views

Content Security Policy Style Hash

I have an img tag on a page with an line style that looks like this: style="height:50px;width:180px;display:block;" I can't move it to an external stylesheet because the img tag is generated by a ...
4
votes
1answer
803 views

SRI for CSP - how do I get the hash for inline code?

I have been messing about with website design for years, but I am no expert - more of a hardware junkie. CSP is fascinating for me now that I am starting to branch out into web development. I was ...
3
votes
2answers
537 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
0
votes
1answer
226 views

HSTS preload and requisites on domain - subdomains must be added too?

I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/ However the ...
0
votes
1answer
167 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
0
votes
1answer
220 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...