Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

High

Content-Security-Policy (CSP)

Defines which content sources are allowed to be loaded by the browser, preventing cross-site scripting (XSS) and data injection attacks.

Risk

Without CSP, an attacker who finds an XSS vulnerability can inject arbitrary scripts into your pages. These scripts can steal user sessions, redirect to phishing pages, modify page content, mine cryptocurrency, or access sensitive data displayed on the page.

Solution

Define a Content-Security-Policy header that whitelists only trusted sources for scripts, styles, images, and other resources. Start with a report-only policy to identify issues before enforcing.

Example

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com

MDN - Content-Security-Policy CSP Evaluator (Google)

Comments (0)

No messages yet.