Controlling Scripts With Content Security Policy: Hashes, Nonces, and strict-dynamic

This post is dedicated to script-src, the directive that controls which scripts your page is allowed to run. We will look at how to use this directive to protect your site, and discuss when to use hashes, nonces and 'strict-dynamic', and see it live in interactive examples.

script-src tells the browser which scripts are allowed to run on your page. It covers external scripts, inline scripts, and inline event handlers.

• External scripts — <script> tags that load a file from a URL.
• Inline scripts — <script> tags injected directly into the page's HTML.
• Inline event handlers — attributes like onclick="..." and onload="..." on HTML elements.

This is the second post in my series about CSP. The first post showed how CSP can prevent XSS, and how CSP influences our decisions during development.

Allowlists

The most common use of script-src is specifying the origins the browser can load scripts from. Everything...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE