AttackVector.tech

What is Content Security Policy?

Discover Content Security Policy: an HTTP header that prevents XSS and data injection by controlling browser resource loading.

Explain Like I'm 5

Think of your web browser like a house with many doors and windows. You want to let in only trusted friends, not strangers who might cause trouble. A Content Security Policy, or CSP, is like a guard at each door, checking IDs to ensure only the right people or things get in. It tells the browser which websites are safe to load things from, like scripts or images, and blocks everything else that could be harmful.

Imagine having a special list of rules for what can and can't come in. These rules are like saying, 'Only scripts from my trusted website can enter,' or 'No strange styles from other places allowed!' This helps keep bad things like computer viruses and sneaky tricks out of your house.

Why does this matter? Without a good CSP, it's like leaving the doors wide open for anyone to walk in and mess with your stuff. Keeping that guard at the door helps prevent bad guys from sneaking in and causing chaos in your web world.

Technical Definition

Definition

Content Security Policy (CSP) is an HTTP header used to prevent cross-site scripting (XSS), data injection, and other code execution attacks by specifying which content sources are trusted by the web application.

How It Works

  1. 1A server sends a CSP header with directives that define content sources for various types of resources (scripts, styles, etc.).
  2. 2The browser reads these directives and enforces them, blocking any resources that do not conform to the policy.
  3. 3The CSP can include 'script-src', 'style-src', 'default-src', and 'connect-src' directives to specify allowed sources for scripts, styles, default resources, and connections respectively.
  4. 4Nonce-based and hash-based approaches can be used to allow specific inline scripts and styles by assigning a unique nonce or hash value.
  5. 5The 'report-uri' directive can be included to send violation reports to a specified endpoint for monitoring purposes.

Key Characteristics

  • Directives: Instructions on where content can be loaded from.
  • Nonce/Hash: Allows specific inline scripts/styles by using unique identifiers.
  • Reporting: Provides a mechanism to report CSP violations.

Comparison

ConceptPurposePrimary Use Case
Content Security PolicyPrevents loading of unwanted resourcesXSS and data injection prevention
Same-Origin PolicyRestricts requests between different sitesProtects confidentiality and integrity of data
Cross-Origin Resource Sharing (CORS)Allows controlled sharing of resources between sitesSecurely sharing resources across domains

Real-World Example

CVE-2019-16759 exploited a lack of proper CSP, leading to a vulnerability in vBulletin that allowed remote code execution through XSS.

Detection & Prevention

  • Testing Tools: Use browser DevTools to inspect CSP headers and test violations.
  • Implementation: Regularly update CSP policies to reflect new trusted sources.
  • Monitoring: Use 'report-uri' to receive reports on policy violations.

Common Misconceptions

  • CSP is a silver bullet: While CSP is powerful, it must be part of a broader security strategy.
  • 'unsafe-inline' is acceptable: Using 'unsafe-inline' negates many benefits of CSP as it allows execution of inline scripts.
  • CSP breaks websites: Properly configured CSP will not break functionality but enhance security.

Keywords

what is Content Security PolicyContent Security Policy explainedContent Security Policy detectionCSP directivesXSS preventionCSP security

Ready to scan your site?

AttackVector uses AI agents to find vulnerabilities before attackers do. Start a free scan now.

Start Free Scan