What is the difference between CSP and XSS?

What is the difference between CSP and XSS?

CSP, or Content Security Policy, is a security feature that helps prevent XSS (Cross-Site Scripting) attacks by controlling which resources can be loaded on a webpage. XSS, on the other hand, is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.

How does CSP help in preventing XSS?

CSP helps prevent XSS by specifying which sources of content are trusted. If a script is loaded from an untrusted source, the browser will block it, thus reducing the risk of executing malicious scripts.

Can you give an example of a CSP rule?

Sure! A simple CSP rule might look like this: Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.com;. This allows scripts to be loaded only from the same origin and from 'trusted.com'.

What happens if a CSP rule is violated?

If a CSP rule is violated, the browser will block the resource from loading and may log a violation report if configured to do so. This helps developers identify potential security issues.