Enable CSP Web security policy to prevent XSS attacks

First, IntroductionCSP is the abbreviation for Web Security Policy (Content security Policies). is a developer-defined security Policy statement that specifies a trusted source of content through the responsibilities that are constrained by the CSP (content can refer to remote resources such as scripts, pictures, style, and so on).       By using the CSP protocol, you can prevent XSS attacks and allow the web to operate in a secure environment. The essence of CSP is the white list system, where developers explicitly tell clients which external resources can be loaded and executed, equivalent to providing a whitelist. Its implementation and execution are all done by the browser, and developers only need to provide configuration. CSP greatly enhances the security of the Web page. The attacker could not inject the script even if a vulnerability was found, unless a whitelist-listed trusted host was also controlled.
second, open the wayOne is: The Content-security-policy field through the HTTP header information. One is: Set up <meta> tags in web pages, such as:

<meta http-equiv="content-security-policy" content="script-src ' self '; Object-src ' None '; STYLE-SRC cdn.example.org third-party.org; CHILD-SRC https:">

Three, chestnuts

1. Prevent the loading of external resources that do not conform to the CSP.

Load resources:

<script type= "Text/javascript" src= "Https://code.jquery.com/jquery-3.2.1.min.js" ></script>

JS can be loaded normally when the CSP is not opened:

After opening:

<meta http-equiv= "Content-security-policy" content= "script-src ' self '; Object-src ' None '; STYLE-SRC cdn.example.org third-party.org; CHILD-SRC https: ">

2, the special value of SCRIPT-SRC

' Unsafe-inline ': Allows <script> tag and event listener functions to be executed inline
' Unsafe-eval ': Allows strings to be executed as code, such as using functions such as Eval, SetTimeout, SetInterval, and so on.
' Nonce ' value: Each HTTP response gives an authorization token, and the page inline script must have this token to execute
' Hash ' value: Lists the hash value of the script code that is allowed to execute, in which case the hash value of the inline script in the page is only matched

such as: Set ' unsafe-inline ' Unsafe-eval '; After that, you can perform the following

<script type= "Text/javascript" >    eval (' SetTimeout (function () { Console.log (1);},1000);</script>    

Learning Links:

Ali Poly Security

Enable CSP Web security policy to prevent XSS attacks