weba/06_xss_demo.md

XSS/CSP Demo

Environment

Demo App -> Addressbook

Demo

check that csp is not set in nginx

Browser

add following name & press "Speichern":

Charlie <div id="out"></div><script>document.onkeypress = function(e) {document.getElementById('out').innerHTML += e.key};</script>

and now type on your keyboard...

CSP

set CSP in nginx config

add_header Content-Security-Policy "default-src 'self'; script-src 'self';" always;

repeat the Demo.