CSP Misconfiguration
Medium · Configuration · CWE-1021
Description
Content-Security-Policy allows unsafe-inline or overly broad sources.
Root cause
Weak script-src/default-src directives.
Impact
XSS still exploitable despite CSP present.
Detection
Review CSP headers; CSP evaluators.
Mitigation
Use nonces/hashes; remove unsafe-inline.
Secure coding
Strict CSP with reporting (report-uri/report-to).
Safe lab example
In-browser lab-csp
Practise related skills in Labs or deepen on Academy library.