Chapter 2 of 7 · 3 practices · 3 min · 4-question quiz
Content Security Policy
A strict Content Security Policy tells the browser which scripts may run, so an injected one does not. These practices get you to a strict policy without breaking the site.
Start: Use a strict, nonce-based CSP instead of a domain allowlist3 practices in this chapter
- 1Use a strict, nonce-based CSP instead of a domain allowlistOlder CSPs listed trusted domains:
script-src 'self' cdn.example.com analytics.example.net. Those are easy to bypass when any allowed domain hosts user content or an old library with an injectable… - 2Use hashes when pages are static or cachedA nonce must change on every response, which does not work for pages served from a CDN cache or built as static HTML. For those, OWASP describes a hash-based policy: list the hash of each allowed…
- 3Roll out CSP in report-only mode and watch the reportsSwitching on a strict CSP in one go usually breaks something: an inline event handler, an analytics snippet, a browser extension's injected script showing up in reports. OWASP's rollout approach…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.