Web Security: Common Vulnerabilities And Their Mitigation - Default directives and wildcards

The video tutorial explains Content Security Policy (CSP) directives, focusing on default source, wildcards, and special keywords like 'self' and 'none'. It discusses browser support, particularly Internet Explorer, and how CSP can be applied on a page-by-page basis. The sandbox directive is introduced, highlighting its role in restricting page actions rather than resources.

What is the primary benefit of using the default source directive in CSP?

• It simplifies specifying multiple directives by providing a default value.

• It blocks all external resources by default.

• It allows loading resources from any domain.

• It enables inline scripts without restrictions.

How can you allow scripts to be loaded from any subdomain of mysite.com?

• By using 'script-src mysite.com'

• By using 'script-src mysite.com:*'

• By using 'script-src *.mysite.com'

• By using 'script-src mysite.com:80'

What does the 'none' keyword signify in a CSP directive?

• No resources of that type are allowed.

• All resources are allowed from any domain.

• Resources are allowed from any secure connection.

• Only resources from the same domain are allowed.

Why is it important to use single quotes around CSP keywords like 'self' and 'none'?

• To ensure they are treated as special keywords, not hostnames.

• To allow them to be used as hostnames.

• To make them case-insensitive.

• To enable them to work in Internet Explorer.

Which CSP keyword allows the use of inline scripts?

• none

• unsafe-inline

• self

• unsafe-eval

What is a key feature of the sandbox directive in CSP?

• It allows all scripts to run without restrictions.

• It enables form submissions from any page.

• It restricts actions that a page can take.

• It allows loading resources from any domain.

How does the sandbox directive affect the origin of a page?

• It makes the page's origin the same as the rest of the site.

• It enforces the page into a unique origin.

• It allows the page to share origin with subdomains.

• It removes all origin restrictions.