3 ms·
Ok, in that case I don't see how headers solve the problem better than: 1) Don't click on bad URLs. (should be taught at kinder-garden by now) 2) Replace all
by bullen 8y ago
Ok, in that case I don't see how headers solve the problem better than:
1) Don't click on bad URLs. (should be taught at kinder-garden by now)
2) Replace all input <> with <> etc.
I'm convinced scripts should not be able to read cookies for other domains?
Surely I'm missing something?
- gmiller123456 7y agoThe Content-Security-Policy header prevents any new JavaScript from getting executed. Any inline scripts have to have a matching nonce, or SHA hash in the CSP header. With XSS, an attacker can insert content into the web page, but they can't modify the headers, so this effectively stops all XSS without some additional vulnerability being exploited.