August 2024
Intermediate to advanced
186 pages
4h 3m
English
A Content Security Policy[71] (CSP) detects and prevents some types of attacks, including Cross-Site Scripting (XSS). It can also report attempted attacks.
A CSP can be enabled with an HTTP response header or with an HTML meta tag. In both cases, the policy is described by a list of directives separated by semicolons.
Each directive is specified with a name and one or more values, all separated by a space. The values are CSP-specific keywords (such as self) and/or allowed URL patterns.
The following meta tag provides an example. It specifies that by default all resource types can only be downloaded from the current origin. An exception is made for images that can come from any origin as long as HTTPS is used. ...
Read now
Unlock full access