CODEWITHSUNDEEP
securityhttp-headersxss
user1224129
user1224129

Reputation: 2779

Is it safe to use Content-Security-Policy Header?

Content-Security-Policy header seems to be a great way to make websites more secure. However we tried to find any large website that is using this header and we didn't find any single one, unlike many other security related headers. That is strange and I would like to know if there any problems (caching, bugs etc) that may be caused by this header.

Upvotes: 2

Views: 1467

Answers (1)

Keith
Keith

Reputation: 155692

Yes, CSP is safe, but you cannot rely on it alone.

CSP will make XSS attacks very difficult (though not impossible) against visitors to your site that have browsers that support it.

Lots of browsers don't support it though - IE11 still doesn't, so you still need to strictly manage any user input displayed or echoed to limit your risk.

Implementing CSP in an existing application can be very painful, to get the full benefit you are stopped from using inline CSS and Javascript. This in turn breaks lots of libraries and frameworks - for instance Modernizer breaks with CSP on.

For this reason it isn't widely used yet.

Upvotes: 2

Related Questions