Content security policy: allowlisted script resources
Summary: PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified in a response header or meta tag. It recommends replacing allowlisted resources in script-based directives with a secure random nonce of at least 8 characters, formatted as 'nonce-RANDOM'.
What you should know: An allowlist in a script directive is only as strong as every resource on it, and the guidance here is to drop the list for a random nonce of at least 8 characters - a small configuration change standing between your site and untrusted JavaScript execution.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026