Content Security Policy explained | how to protect against Cross Site Scripting (XSS) 

Loved it. Thank you.

Thanks man.

you're most welcome

I'm glad you liked it

thx Noel, I'm glad I could help!

thx Ahmed 👍

you're welcome Hekar

Glad it was helpful!

thx

thx

My pleasure!

Glad you enjoyed it!

Thanks!

You are welcome!

Glad you liked it!

Thanks!

thx Sanket 👍

you're welcome

Glad you enjoyed it

Thanks for liking

Glad it was helpful!

Glad it was helpful!

Thanks!

nice 👍

Hi Chad, if you store a JWT inside of a cookie then your api-gateway needs a strict CORS policy and ideally HttpOnly and Secure cookies to prevent CSRF. However, CORS and cookies do not sufficiently protect you against XSS. Because with XSS some malicious code is running in browser. So in case the JWT is stored in a cookie - even if it is HttpOnly - the attacker can still make authenticated requests. The only "advantage" over using local storage here is that the attacker would need to run the full attack over the browser. This is still bad and the attacker can do pretty much anything he wants to do but at least the attacker does not get access to the actual token. So while the attacker could still do everything via the browser, it would be slightly harder. To protect against XSS, a Content Security Policy is very useful as well as sanitizing user input when it is sent to the server. I think I don't really have a dedicated video that yet.

Hi Johnny, here is a really nice answer for your question: webmasters.stackexchange.com/questions/104857/when-should-i-not-to-use-page-meta-security-headers

Not literally like this. You have to replace and with your own directive and value you would like to use. Also make sure to separate these two placeholders with a space. So an example would be

Hi Yuvraj, https is TLS over HTTP and all headers that can be encrypted, are encrypted (hostname / IP headers are not encrypted because otherwise routing of the package would be impossible: stackoverflow.com/a/187679/2328833)

no, I'm from Germany

haha nice 👍

Hi Saurav, while you could allow any script this would defeat the purpose of having a CSP in the first place. So I figure the only way would be to explicitly add the sources where you want to load scripts from. If you specify self, then this means that you only allow scripts to come from the origin where the webpage was originally loaded from

@@jgoebel how can i make it accept the scripts that i have written on some script tags inside some pages?

CSP is independent of any cloud service

no because the browser enforces the CSP. But pretty much every modern browser supports CSP these days

Thanks

could be. Some servers allow you to just pass a config file and then the server will generate the headers for you

probably because RU-vid thinks that you are trying to do a stored cross site scripting (XSS) attack 😁

nice try 😁