Intermediate LevelWeb Security & Cyber Defense
How do attackers attempt to bypass weak Content Security Policies and how do you harden CSP?
❓ Interview Prompt: Explain CSP bypass techniques (`unsafe-inline`, `unsafe-eval`, trusted JSONP endpoints), `strict-dynamic`, and hash-based script security.
Weak Content Security Policies provide a false sense of security:
Common CSP Bypasses:
1
'unsafe-inline' / 'unsafe-eval': Allows arbitrary inline scripts and string code execution.
2
Domain Whitelist Bypasses: Whitelisting 'script-src https://cdn.example.com' allows attackers to exploit hosted JSONP endpoints ('?callback=alert(1)') on that CDN to execute script payloads!
Modern Hardening ('strict-dynamic'):
'script-src 'nonce-rAnd0m' 'strict-dynamic''
•
Trust is bound strictly to the cryptographic nonce. Scripts loaded dynamically by a trusted nonced script inherit execution rights automatically!
Code Implementation Example
http
Content-Security-Policy: default-src 'self'; script-src 'nonce-b384f9a' 'strict-dynamic'; object-src 'none'; base-uri 'none';💡Strict nonce-based CSP header with strict-dynamic directive.
🎯 Interview Key Takeaway
Harden CSP using nonces and strict-dynamic instead of domain whitelists to block JSONP bypasses.
#CSP Bypass#strict-dynamic#Nonces#Intermediate
Back to all Web Security & Cyber Defense Questions→