Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

High

CSP Not Effective Against XSS

Your Content Security Policy is missing or does not effectively prevent cross-site scripting attacks.

Risk

A weak or missing CSP allows attackers to inject malicious scripts via XSS vulnerabilities. These scripts can steal cookies and sessions, capture keystrokes, modify page content, redirect users to phishing sites, or perform actions on behalf of the user. CSP is the most effective defense-in-depth measure against XSS.

Solution

Implement a strict CSP that uses nonces or hashes instead of 'unsafe-inline'. Avoid 'unsafe-eval'. Use 'strict-dynamic' for trusted script loading. Test with Content-Security-Policy-Report-Only first.

Example

Content-Security-Policy: script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'self'

CSP - web.dev CSP Evaluator

Comments (0)

No messages yet.