How to Get Started with Your Website Content Security Policy

This article is part of a series created in partnership with SiteGround. Thank you for supporting the partners who make SitePoint possible.

The web is based on a "same-origin" policy. Only code at mysite.com can access mysite.com's data in cookies, localStorage, Ajax requests etc. It is isolated from other domains so any access attempts from evilsite.com will be rejected.

Unfortunately, it's never that simple. Modern websites are complex and load a variety of third-party components, styles and scripts. A script loaded from another domain runs in the context of the current page and can do whatever it likes. That social networking button could monitor visitors, hijack login cookies, change page content and more. Even if you trust the third-party site, you could become victim to a man-in-the-Middle attack where the script is changed before it reaches you. Alternatively, it could permit users to launch their own Cross Site Scripting attacks (XXS).

By default, browsers implement an anything-goes approach. Fortunately, it's possible to apply restrictions using a Content Security Policy (CSP) which prevent unexpected security issues. A CSP tells the browser what's permitted, e.g. run JavaScript at mysite.com but only from files and not inline <script> tags.

Continue reading %How to Get Started with Your Website Content Security Policy%

by Craig Buckler via SitePoint