What's CSP? Why do you need it on your website?

Content Security Policy CSP is an additional security layer designed to detect and weaken certain types of attacks, including cross-site scripts (XSS) and data injections. Through Configuration CSP, you can tell the browser which external resources (scripts, styles, pictures, frames, etc.) are allowed to load and execute.

CSP How to Resist XSS Attack?

In the traditional Web In the environment, the browser cannot distinguish between scripts that are legitimate codes injected by the site developers or codes that the attackers use to inject in malice through loopholes. Enable After CSP:

Limit inline scripts: You can disable all inline scripts and force all JSs to load from trusted domain names.
Source white list: Specify only from https://apis.google.com or 'self' . Scripts can only be run.
Disable eval(): CSP will be disabled by default eval() . The same dangerous string-to-code function.

Address common pain points of CSP leading to website failure

Many developers are trying to deploy the CSP for the first time. This is often the case when the picture is not displayed, scripts are misreported or third-party plug-ins are invalidated. This is usually due to the fact that the strategy is too strict. With our tools, you can:

Particle size control: Both script-src , style-src , img-src . The command sets different sources.
Visual configuration: By Check 'unsafe-inline' or 'unsafe-eval' (although not recommended, sometimes necessary transition programmes) to test compatibility.
Multiformat export: One-click generation for Nginx configuration file or HTML <meta> label format.

New feature for CSP Level 3

Modern browser has supported CSP Level 3, introduced 'strict-dynamic' And I'm going to be a little bit more intelligent. This allows a trusted root script to dynamically load other dependent scripts, greatly simplifying the maintenance of large-scale applications of white lists. Our generator is perfect for these high-level features.

Implementation recommendation: step-by-step deployment

Don't deploy the most stringent tactics at once. The recommended processes are:

Report-Only mode: Use Content-Security-Policy-Report-Only Head, browser will send the default report to the URL you specify, but will not prevent any resource loading.
Analytical report: Checking for legal third-party resources was stopped and added to the white list.
Formally enforce: After confirming that there was no misreporting, switch the head to Content-Security-Policy 。