What is Content Security Policy (CSP)?

Response headers that allows web site administrators to control which resources are loaded on a given page. We control this by setting policies structured below:

Content-Security-Policy: <policy-directive>; <policy-directive>

The following example creates a default source to 'self' (server origin) and a style-src to 'self' and allows any css loaded from a somedomain.com domain:

Content-Secuirty-Policy: default src 'self'; style-src 'self' *.somedomain.com;

What is Cross-Site Scripting (XSS)?

Cross-SIte Scripting, is a client-side code injection attack. One type of vulnerable a page has to this kind of attacks if it does not validate or encode text that is entered to it's input control. With this a hacker can input a malicious script on the text then when saved and loaded back, the page would then execute that script.

Types of XSS Attacks

Embedding of External Resources on the Page
Writing Scripts to the Page Source
Modifying the Document Object Model (DOM)

Please find link on the References section below for more information about Cross-Site Scripting.

Commonly Used Directives

Policy Directive	Description
default-src	This directive contains the default values, for example if script-src is not specified, it used what is set on the default-src
script-src	This directive controls the script resources locations (.js files), if we have referenced remote scripts we can specify the url for that on this directive
style-src	This directive controls the style resources locations
object-src	This directive controls being loaded on the page ex. flash
media-src	This directive controls the media resources being loaded ex. mp3
frame-ancestors	This directive controls which sources can load the page into a child frame

For other directives please refer to the link found on the References section below

Built-in Directive Values

Source Name	Description
'self'	Refers to the origin from which request/response is being served. This allows all scripts from the origin server.
'none'	Explicitly disallow script sources
'unsafe-inline'	Allows scripts that are coded in-line: ex: <button id='sampleId' onclick='confirm('are you sure?')' />
'unsafe-eval'	Allows scripts that use the eval() method, which creates javascript code from strings ex: var value = eval(new String(a + b))