Content-Security-Policy: An Introduction

Content-Security-Policy (CSP) is a major control to protect against Cross-Site Scripting Attacks. This video talks about both offensive and defensive perspectives of Content-Security-Policy implementations for your application
For more such content, subscribe to my channel dedicated to security:
/ appsecengineer

[@codedynamics1]

I found this video a while ago and saved it. This fundemental for websites and web applications to mitigate XSS attacks. I came across a 'trusted scripts assignment' error in the console and after a ton of research i've started implementing a CSP header (you can also use the meta tag to set a CSP) but i still needed more info so i came back here. Thanks for taking time to make this video Abhay i can see that you've gone through some lengths to hide personal info before uploading the video so its really appreciated and its going to help alot.

[@ramanjha2277]

This is one of the best videos I have ever seen on any topic.

[@abhaybhargav]

Thank you

[@goodthoughtwelike]

Abhay, this is one of the best presentations. This whole video is able to maintain the curiosity. Thanks a lot.

[@abhaybhargav]

Thank you very much for your compliments :)

[@ellaiyarasankalidass5267]

Great content, learnt valuable lesson from you as a web developer.

[@GaneshPrabhuRajendran]

This is best video for learning CSP

[@hitnahsin]

Thanks for the information , explanation and your time !!!

[@abhaybhargav]

Thanks :)

[@kobicohen3205]

great explanation... good luck Abhay

[@aravindgop1]

It was a very professional presentation.. I especially liked the courtesy links that you have posted towards the end ... 👍🏻

[@abhaybhargav]

Thank you!

[@ajayKumar-yc4mf]

Very Well explained, the details you go into are very helpful

[@sandeepdantuluri3414]

Great n unique way of explanation sir.
Waiting to learn more concepts 👌👌

[@abhaybhargav]

Thank you!

[@olenaback1212]

This is a very perspicuous explanation/ intro into CSP! Thanks!

[@abhaybhargav]

Thank you!

[@AmanMankar]

Hey Ashish, quick question. if I have 'connect-src *' but have explicitly limited script-src and all other derivatives to a particular domain, how much of a threat is it?

You explained it very well. Concept is clear to me. But how do I get my javascript loaded without errors. I have very little knowledge of Java and have played with a bit. I found which files causing the errors but how do I correct this. Where do I inject the nonce or hash code in my files or remove the errors in my javascrips?

[@_justinprojects]

very thorough, thanks for the demo!

[@johnybandlamudi1838]

Thank you for the detailed explanation.

[@abhaybhargav]

Thank you

[@dougthefiddler]

Awesome information - really clear - thanks!

[@abhaybhargav]

Thank you!

[@shikharjoshi267]

This video is gold.

[@abhaybhargav]

Thank you :)

[@GopalSinghR1]

Excellent Explanation

[@ritiksahni542]

A great presentation! Loved it.

[@abhaybhargav]

Thank you

[@antonyshaji2008]

Much appreciated. thanks.

[@robl39]

I finally get it. Thanks!

[@abhaybhargav]

Glad you found it useful

[@domaincontroller]

07:37 set by the (Application) server 08:19 my web server would indicate to the browser via an HTTP header, from the same origin server

[@sundargeek4915]

Dude, This is good

[@abhaybhargav]

Thanks mate

[@subhadharshini9303]

presentation was very neat and good. Very much helpful

[@abhaybhargav]

Thank you!

[@samuelbotini8547]

wow bro it's an awesome explanation, tanks for this, and your english pronunciation it's amazing

[@abhaybhargav]

Thank you Samuel :)

[@AmarSingh-uw1db]

Awsome, explanation sir great 👍

[@abhaybhargav]

Thank you!

[@alucardjp1]

Great video

[@abhaybhargav]

Thank you!

[@TheBikerr]

Very informative Video, One request please share link to the source code of the application...

[@venkateswarareddy5137]

Nice Presentation!

[@abhaybhargav]

Thank you!

[@jeganofsathyabama]

Willing to talk to you around some appsec problems that i want to solve for my company.
Kindly accept my invite on LinkedIn