Web Security: Common Vulnerabilities And Their Mitigation - Rules for the browser

The video tutorial explains how to protect websites from cross-site scripting attacks using Content Security Policy (CSP). It covers the role of headers and metadata in web security, detailing how CSP directives and source expressions can specify trusted sources for scripts, images, and other content. The tutorial also discusses advanced CSP directives and their practical implementation to enhance website security.

What is the primary purpose of a Content Security Policy (CSP) in modern browsers?

• To enhance website aesthetics

• To reduce the risk of cross-site scripting attacks

• To increase website loading speed

• To improve search engine rankings

How do CSP headers communicate between the server and the client?

• Via metadata in headers

• Through HTML comments

• Through cookies

• Using JavaScript alerts

What does the 'self' directive in a CSP header indicate?

• Only images are trusted

• All sources from the same domain are trusted

• All external sources are trusted

• No sources are trusted

Which directive would you use to specify trusted sources for scripts in a CSP header?

• image-source

• font-source

• style-source

• script-source

What happens if a script from an untrusted source tries to load on a website with a CSP?

• The script is loaded with a warning

• The script is blocked and an error is shown

• The script is automatically trusted

• The script is ignored without any notification

Which directive controls the origins from which images can be loaded?

• font-source

• child-source

• image-source

• script-source

What is the role of the 'form-action' directive in a CSP?

• To block all form submissions

• To control the style of forms

• To allow forms from any source

• To specify valid endpoints for form submissions

Which directive would you use to control the origins for loading fonts?

• image-source

• script-source

• media-source

• font-source

What does specifying a CSP header with '*' for every directive imply?

• Only scripts are allowed

• All content is allowed

• All content is blocked

• Only images are allowed

Why is it important to specify a CSP header?

• To restrict content loading and reduce security risks

• To improve website aesthetics

• To allow all content from any source

• To increase website speed