What are XSS and CSP in web security?

What are XSS and CSP in web security?

XSS, or Cross-Site Scripting, is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. CSP, or Content Security Policy, is a security feature that helps prevent XSS by specifying which content sources are trusted.

How does CSP help mitigate XSS attacks?

CSP mitigates XSS by allowing developers to define a whitelist of trusted sources for scripts, styles, and other resources. If a script is not from a trusted source, the browser will block it.

Can you give an example of a CSP policy?

Sure! A simple CSP policy might look like this: Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.com; This allows scripts only from the same origin and from 'trusted.com'.

What are some common XSS attack vectors?

Common XSS attack vectors include injecting scripts through input fields, URL parameters, or even cookies. Attackers exploit these to execute malicious code in the user's browser.