High ThreatWeb & Injection DefenseCWE-79
Strict Content Security Policy (CSP): Nonce-Based Protection
Deploy Strict CSP using nonces for script protection, reporting mechanisms, and mitigating cross-site scripting (XSS) attacks.
Vulnerability Overview
Weak CSPs fail to prevent XSS execution.
Attackers inject scripts that bypass broad whitelist CSPs.
Vulnerable Code
<meta http-equiv='Content-Security-Policy' content="script-src 'self' 'unsafe-inline'">Allows inline scripts.
Remediated Code
<script nonce="base64_nonce">...</script>Requires unpredictable nonces.
Hardening Rules
- 1Use script-src with nonces
- 2Avoid unsafe-inline
- 3Implement report-uri
Frequently Asked Questions
Can CSP replace escaping?
No, CSP is a defense-in-depth measure, not a replacement for output encoding.