What is XSS (Cross-Site Scripting)? How to combat it? What is CSP?

XSS (Cross-Site Scripting) is a vulnerability of web applications where an attacker injects malicious scripts (usually JavaScript) into pages viewed by other users. This allows performing unwanted actions on behalf of the user, such as stealing cookies, sessions, or redirecting to phishing sites.

To combat XSS, several approaches are used:

• Output escaping: all data entered by the user and displayed on the page should be properly escaped depending on the context (HTML, attributes, JavaScript).
• Input validation and filtering: restricting and checking the entered data.
• Using Content Security Policy (CSP): this is an HTTP header that allows restricting sources of scripts, styles, and other resources, thereby reducing the risk of executing injected code.

CSP (Content Security Policy) is a security mechanism that allows the developer to explicitly specify which content sources are permitted to load and execute in the browser. For example, you can allow scripts only from your own domain and block inline scripts.

Example CSP header:

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com

This restricts script loading to the current domain and the specified CDN, blocking any others.