Support Content Security Policy for Web transports

[oberstet]

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.

In works like this:

1. a Web server set CSP via a HTTP response headers (Content-Security-Policy and X-XSS-Protection
2. a compliant Web browser will enforce the CSP set in the HTTP response header set on the document loaded for the main browsing context
3. the CSP can limit the origins from where stuff like images, stylessheets and of course JS can be loaded (that would run in the original browsing context!)

References:

• https://www.w3.org/TR/csp-embedded-enforcement/
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://codeburst.io/content-security-policy-with-amazon-cloudfront-part-1-5505feeaa75
• https://codeburst.io/content-security-policy-with-amazon-cloudfront-part-2-10086888d11a
• https://www.savjee.be/2018/05/Content-security-policy-and-aws-s3-cloudfront/

[oberstet]

Overview:

• https://en.wikipedia.org/wiki/Content_Security_Policy

Browser support and lots more:

• https://content-security-policy.com/
• https://caniuse.com/#feat=contentsecuritypolicy
• https://caniuse.com/#feat=contentsecuritypolicy2

Test browser support:

• https://content-security-policy.com/browser-test/