Content Security Policy (CSP) in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the directive that controls which sources are allowed to load scripts.

Cybersecurity

Content-Security-Policy: [1] 'self';

Drag options to blanks, or click blank then click option'

Astyle-src

Bimg-src

Cscript-src

Dconnect-src

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'img-src' which controls images instead of scripts.

The script-src directive controls which sources are allowed to load JavaScript scripts.

2fill in blank

medium

Complete the code to allow resources only from the same origin.

Cybersecurity

Content-Security-Policy: default-src [1];

Drag options to blanks, or click blank then click option'

A'*'

B'none'

C'unsafe-inline'

D'self'

Attempts:

3 left

💡 Hint

Common Mistakes

Using '*' which allows all sources, not just same origin.

The 'self' keyword allows loading resources only from the same origin as the page.

3fill in blank

hard

Fix the error in the CSP header to block all inline scripts.

Cybersecurity

Content-Security-Policy: script-src [1];

Drag options to blanks, or click blank then click option'

A'unsafe-inline'

B'none'

C'self'

D'unsafe-eval'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'unsafe-inline' which allows inline scripts.

Using 'none' blocks all script sources including inline scripts.

4fill in blank

hard

Fill both blanks to allow images only from the same origin and trusted domain.

Cybersecurity

Content-Security-Policy: img-src [1] [2];

Drag options to blanks, or click blank then click option'

A'self'

Bhttps://trusted.com

C'none'

D'unsafe-inline'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'none' which blocks all images.

The img-src directive allows images from the same origin ('self') and the trusted domain https://trusted.com.

5fill in blank

hard

Fill all three blanks to create a CSP that allows styles from the same origin, scripts only from a CDN, and blocks all inline scripts.

Cybersecurity

Content-Security-Policy: style-src [1]; script-src [2] [3];

Drag options to blanks, or click blank then click option'

A'self'

Bhttps://cdn.example.com

C'none'

D'unsafe-inline'

Attempts:

3 left

💡 Hint

Common Mistakes

Including 'unsafe-inline' which allows inline scripts.

This CSP allows styles only from the same origin ('self'), scripts only from the CDN (https://cdn.example.com), and blocks inline scripts by using 'none' alongside the CDN.