Content Security Policy Header [How to Implement]

Find out why it is important to implement a content security policy header.
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution.

The importance of the issue

A primary goal of CSP is to mitigate and report XSS attacks. XSS attacks exploit the browser's trust in the content received from the server. Malicious scripts are executed by the victim's browser because the browser trusts the source of the content, even when it's not coming from where it seems to be coming from.

CSP makes it possible for server administrators to reduce or eliminate the vectors by which XSS can occur by specifying the domains that the browser should consider to be valid sources of executable scripts. A CSP compatible browser will then only execute scripts loaded in source files received from those allowed domains, ignoring all other scripts (including inline scripts and event-handling HTML attributes).

As an ultimate form of protection, sites that want to never allow scripts to be executed can opt to globally disallow script execution.

How to fix the issue

To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header.

Get more info about implementing Content Security Policy for different cases here:
#csp
#cspsetup

[joegood]

So you didn't really mean [How to Implement].

[praveenkaramadi]

heading doesn't match video content, looks like its only posted to get some views