Question 1

What is a Content Security Policy?

Accepted Answer

A Content Security Policy (CSP) is an HTTP response header that tells the browser which sources of content are allowed to load on a page. CSP prevents Cross-Site Scripting, clickjacking, and other code injection attacks by restricting where scripts, styles, images, fonts, and other resources can be loaded from. When a resource violates the policy, the browser blocks it and optionally reports the violation.

Question 2

What is the difference between CSP Level 2 and Level 3?

Accepted Answer

CSP Level 2 introduced nonce-based and hash-based script allowlisting, the base-uri directive, and the form-action directive. CSP Level 3 added the 'strict-dynamic' keyword, the 'report-sample' keyword, and the worker-src directive. Level 3 also introduced navigate-to for controlling navigation targets. Most modern browsers support Level 3.

Question 3

Should I use 'unsafe-inline' in my CSP?

Accepted Answer

Avoid 'unsafe-inline' for script-src because it defeats CSP's primary XSS protection. If inline scripts are allowed, any injected script will also execute. Instead, use nonce-based CSP or hash-based CSP. For style-src, 'unsafe-inline' is more acceptable because inline styles are a lower-risk vector, though nonce-based styles are still preferred.

Question 4

How do I deploy CSP without breaking my site?

Accepted Answer

Start with Content-Security-Policy-Report-Only instead of Content-Security-Policy. This header logs violations without blocking resources, letting you identify what would break. Monitor the violation reports, adjust your policy to allow legitimate resources, and repeat until violations are only from actual threats. Then switch to the enforcing header.

Question 5

What is strict-dynamic and when should I use it?

Accepted Answer

'strict-dynamic' tells the browser to trust scripts loaded by already-trusted scripts. When combined with a nonce, you only need to add the nonce to your top-level scripts — any scripts they dynamically load are automatically trusted. This simplifies CSP for applications using script loaders, tag managers, or dynamically created script elements.

Question 6

What is the difference between stored and reflected XSS?

Accepted Answer

Stored XSS persists on the server — the malicious script is saved in a database or file and served to every user who views the affected page. Reflected XSS is transient — the malicious script is part of a URL or form submission and only executes when a victim clicks a crafted link. Stored XSS is more dangerous because it does not require social engineering to trigger and affects all visitors to the compromised page.

Question 7

Does React automatically prevent XSS?

Accepted Answer

React escapes values embedded in JSX by default, which prevents most XSS attacks in rendered content. However, React does NOT protect against XSS when you use dangerouslySetInnerHTML, pass user input to href or src attributes (javascript: URLs), use eval() or Function() with user data, or render user-controlled content in style attributes. These are the common React XSS bypass vectors.

Question 8

Is input validation enough to prevent XSS?

Accepted Answer

No. Input validation alone is insufficient because there are hundreds of encoding and obfuscation techniques that can bypass input filters. The primary defense is output encoding — escaping data at the point where it is inserted into the page. Input validation is a useful secondary layer (defense in depth), but it should never be your only XSS defense.

Question 9

What Content Security Policy directives prevent XSS?

Accepted Answer

The most important CSP directive for XSS prevention is script-src, which controls where JavaScript can be loaded from. Setting script-src to 'self' with specific allowed domains blocks inline scripts and scripts from unauthorized origins. Adding 'strict-dynamic' with nonce-based CSP provides the strongest protection. The object-src 'none' directive also prevents XSS via plugin-based vectors like Flash.

Question 10

How do I test my application for XSS vulnerabilities?

Accepted Answer

Use a combination of automated scanning and manual testing. Tools like Burp Suite, OWASP ZAP, and Semgrep can detect common XSS patterns. For manual testing, inject test payloads in every user input field, URL parameter, HTTP header, and cookie value. Test with payloads that use different encoding schemes (HTML entities, URL encoding, Unicode, hex). Check both the immediate response and stored data that renders later.

LochBot

About LochBot

Quick facts about LochBot

Key Features

Security Analysis

Data Encoding & Conversion

Use Cases

Pricing

Integrations(24)

Built for

Frequently asked questions

Reviews (0)

Quick Info

Traffic Sources

Alternatives to LochBot

Activepieces

Adaptor Die

Adept

Adereso

AG11 Lab

Compare LochBot head-to-head