Web Security: Common Vulnerabilities And Their Mitigation - The nonce attribute and the script hash

The video tutorial covers the importance of avoiding inline scripts for web security and introduces methods to safely use them when necessary. It explains the use of the nonce attribute and script hashing to whitelist inline scripts under Content Security Policy (CSP). The tutorial also provides guidance on implementing CSP in existing production sites, including using report-only mode to identify and fix violations before full enforcement.

Why is it recommended to avoid using inline scripts on a secure website?

• They can lead to cross-site scripting vulnerabilities.

• They are not supported by all browsers.

• They are difficult to maintain.

• They increase the website's loading time.

What is the purpose of the nonce attribute in a script tag?

• To uniquely identify and whitelist a specific inline script.

• To provide a fallback for unsupported browsers.

• To improve the script's performance.

• To specify the script's execution order.

How should a nonce be generated for each page response?

• By using the same ID for all responses.

• By using a secure random ID that changes with each response.

• By using a timestamp.

• By using a hardcoded value.

What is an alternative method to nonce for whitelisting inline scripts?

• Using a script tag.

• Using a script URL.

• Using a script ID.

• Using a script hash.

What must be done if the JavaScript content of a script tag changes?

• The script tag must be removed.

• The nonce must be updated.

• The hash must be regenerated.

• Nothing, the hash remains the same.

How can you obtain the hash for a script using Chrome developer tools?

• By using a third-party tool.

• By manually calculating the hash.

• By running the script with the content security policy header set.

• By inspecting the script tag in the HTML.

What is the purpose of the report-only mode in content security policy?

• To disable content security policy.

• To report violations without enforcing restrictions.

• To allow all scripts by default.

• To enforce restrictions immediately.

What is the benefit of using report-only mode before fully implementing content security policy?

• It speeds up the website's performance.

• It automatically fixes all security issues.

• It allows developers to identify and fix violations.

• It provides detailed error logs.

What is a major challenge when implementing content security policy on existing websites?

• It increases the website's loading time.

• It is not compatible with modern browsers.

• It requires a complete redesign of the website.

• It involves a major rewrite of the system.

Why is it easier to implement content security policy on a new website?

• The website is already optimized for security.

• There are fewer dependencies to manage.

• The website has fewer pages.

• The policy is automatically applied.