CSP is large and sprawling, but a "strict" subset of the policy language is _very_ effective at mitigating injection attacks (XSS). rolled that subset out at Google-scale, and walks through the mechanism in detail in web.dev/strict-csp/.
It's worth your time to read.
Quote Tweet
If you want to learn how to mitigate XSS with a strict CSP based on nonces or hashes read:
web.dev/strict-csp/
The "strict" CSP approach:
doesn't suffer from allow-list bypasses,
doesn't need customisation and
effectively reduces the attack surface of your app.
doesn't suffer from allow-list bypasses,
doesn't need customisation and
effectively reduces the attack surface of your app.1
30
54
