3 ms·
From what I've seen, no -- but that depends what you mean by "properly configured." If you look at challenges like this ( https://github.com/cure53/XSSChalleng
by david_shaw 11y ago
From what I've seen, no -- but that depends what you mean by "properly configured."
If you look at challenges like this ( https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22 https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minicha... ), you'll see that CSP appears to be properly configured, but there are actually ways to bypass. It's problems like this that I've seen "in the wild" most of the time.
The other side of the argument is that not many people are building web applications with CSP built-in from the beginning. If you don't start development with CSP in mind, it can become very cumbersome to put CSP into place (outside of report-only mode). As a result, a lot of people are currently using CSP as just report-only analytics on potential violations.