CSP Explained — The Header That Stops XSS Attacks

Your code has an XSS vulnerability. An attacker injects a script tag. But nothing happens. The browser refuses to run it. Why? Because of one HTTP header.

Content Security Policy tells the browser exactly what your page is allowed to load — scripts, styles, images, connections, everything. If it's not on the allowlist, it doesn't run. In this video, we break down what CSP is, walk through every key directive, explain source values like 'self' and nonces, watch CSP block XSS attacks in real time, cover report-only mode for safe deployment, and expose three misconfigurations that make CSP completely useless.

This isn't theory. These are real patterns from production systems.

Timestamps:
0:00 Introduction — Your Page, Your Rules
0:54 What Is CSP? The Response Header That Controls Everything
2:03 CSP Directives — script-src, style-src, img-src, connect-src, default-src
2:56 Source Values — 'self', 'none', nonces, unsafe-inline
3:54 CSP In Action — Blocking XSS Attacks Live
5:02 Report-Only Mode — Deploy Safely, Monitor, Then Enforce
6:02 Dangerous Misconfigurations — unsafe-inline, Wildcards, Missing default-src
7:23 Summary — What We Covered & What's Next

What you'll learn:
- CSP is a response header that tells the browser what resources your page can load
- Key directives: script-src, style-src, img-src, connect-src, default-src
- Safe sources: 'self', 'none', specific domains, nonces, hashes
- Why 'unsafe-inline' and 'unsafe-eval' defeat CSP's XSS protection
- How CSP blocks both external script injection and inline XSS
- Report-only mode: monitor violations before enforcing in production
- The 3-step deployment: report-only → monitor & fix → enforce
- Why wildcard sources and missing default-src create real attack vectors
- Nonces: the right way to allow inline scripts without unsafe-inline

Previous video: CORS & Same-Origin Policy
Next video: Clickjacking & X-Frame-Options

#WebSecurity #CSP #ContentSecurityPolicy #CyberSecurity

Видео CSP Explained — The Header That Stops XSS Attacks канала GyanByte