Common Content-Security-Policy mistakes

A Content-Security-Policy only helps if it forbids what an attacker needs. The usual ways a policy ends up permitting injected script, and how to check yours.

A Content-Security-Policy is a response header that tells the browser which scripts, plugins and frames the page may use. Its main job is to stop injected script from running when a site has a cross-site scripting hole, and it can also stop other sites from framing your page. It only does that job if the header forbids the things an attacker needs. A policy can look thorough, pass a casual glance and still allow all of them, so this guide goes through the habits that empty a policy of meaning and what to write instead.

Read the full report on AISkills402: https://aiskills402.com/blog/csp-header-mistakes?utm_source=devto&utm_medium=social