Beginner LevelWeb Security & Cyber Defense
What is Content Security Policy (CSP) and how do script-src directive nonces restrict script execution?
❓ Interview Prompt: Explain CSP HTTP header, `default-src`, `script-src`, nonces (`'nonce-rAnd0m'`), hashes, and mitigating XSS script execution.
Content Security Policy (CSP) is an HTTP response header that restricts which domain origins and resources (scripts, styles, images, iframes) the browser is allowed to load and execute:
Key Directives:
•
'default-src 'self'': Restricts resource loading to same domain by default.
•
'script-src 'self' 'nonce-rAnd0m234'': Disables inline '<script>' tags and 'eval()' execution unless the inline script tag includes a matching single-use cryptographic nonce ('<script nonce="rAnd0m234">').
Code Implementation Example
http
HTTP/1.1 200 OK
Content-Type: text/html
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-2726c7f26c'; object-src 'none'; base-uri 'self';💡HTTP Content-Security-Policy header enforcing strict nonce script restrictions.
🎯 Interview Key Takeaway
CSP HTTP headers restrict executable script sources and disable dangerous inline scripts to neutralize XSS attacks.
#CSP#Headers#XSS Defense#Beginner
Back to all Web Security & Cyber Defense Questions→