Content Security Policy (CSP) Directives & XSS Mitigation

What is a Content Security Policy?#

Content Security Policy (CSP) is an HTTP response header that restricts the sources from which browsers can load and execute scripts, stylesheets, images, fonts, media, and object plugins. It is recognized by modern web security standards as the single most effective defense-in-depth mechanism against Cross-Site Scripting (XSS) and data injection attacks.

Even if an attacker finds a flaw in your input sanitization, a well-formed CSP prevents unauthorized inline scripts from executing and blocks outgoing data exfiltration to attacker-controlled origins.

---

What SiteSecura's CSP Analyzer Audits#

SiteSecura parses the Content-Security-Policy header and checks for the following vulnerabilities:

1. Missing CSP Header#

• Impact: FAIL (High Severity, -15 pts). Without a CSP, the browser will execute any inline script or load assets from any external domain.

2. Presence of 'unsafe-inline' in script-src#

• Impact: WARNING (High Severity). The 'unsafe-inline' token disables the primary protection of CSP by allowing inline <script> blocks and inline event handlers (e.g. onclick) to execute without validation.
• Remediation: Transition to cryptographic nonces (e.g., 'nonce-rAnd0m') or SHA-256 hashes for legitimate inline scripts.

3. Presence of 'unsafe-eval' in script-src#

• Impact: WARNING (Medium Severity). Allows strings to be executed as code via JavaScript's eval(), setTimeout("code"), and Function(), a frequent exploitation path for complex client-side injections.

4. Overly Permissive Wildcards (*)#

• Impact: WARNING (Medium Severity). Setting script-src * or default-src * permits assets to load from any domain on the internet, effectively nullifying the whitelist.

5. Missing object-src 'none'#

• Impact: WARNING (Low Severity). Flash, Java applets, and ActiveX controls are legacy attack vectors. If object-src is omitted, it falls back to default-src. It should be explicitly restricted to 'none'.

6. Modern Clickjacking Defense (frame-ancestors)#

• Impact: Replaces the older X-Frame-Options header with granular origin whitelisting:

  HTTP
  Copy
  frame-ancestors 'self' https://trusted-partner.com;

---

Phased CSP Rollout Strategy#

Deploying a strict CSP on an existing website can break analytics scripts, marketing tags, or custom UI elements if configured hastily. SiteSecura recommends a three-phase rollout:

Phase 1: Audit with Report-Only Mode#

Deploy the policy using the Content-Security-Policy-Report-Only header. The browser will not block any resources, but will send violation reports to your specified endpoint:

HTTP
Copy
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://trusted-cdn.com; report-uri /api/csp-report;

Phase 2: Refactor Inline Scripts#

Audit violation reports and remove hardcoded inline event handlers. For required inline scripts, generate server-side nonces:

HTML
Copy
<!-- Server generates unique cryptographically random nonce per request -->
<script nonce="EDNnf03nceIOfn39fn3e9h3sdfa">
  console.log("Authorized inline script");
</script>

Phase 3: Enforce the Policy#

Once report-only violations drop to zero, switch the header from Content-Security-Policy-Report-Only to the enforcing Content-Security-Policy header.

---

Production Configuration Example#

A hardened, modern baseline CSP suitable for modern web applications:

HTTP
Copy
Content-Security-Policy: default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self';

Nginx Implementation:#

NGINX
Copy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;

---

Testing Your CSP#

Paste your active or proposed policy into the SiteSecura CSP Policy Analyzer. The analyzer provides instant directive-by-directive evaluation, highlighting high-risk bypasses, missing directives, and deprecation notices.