🚨 Content Security Policy (CSP) Demonstration

⚠️ Current CSP Mode: WEAK

CSP Header: default-src 'self' 'unsafe-inline' 'unsafe-eval' *

Description: Weak CSP - allows inline scripts and eval

Test Different CSP Configurations:

XSS Test Buttons (click to test CSP effectiveness):

External Resource Tests:

Try loading external JavaScript:

CSP Vulnerability Analysis:

'unsafe-inline' allows inline scripts and styles - defeats XSS protection
'unsafe-eval' allows eval(), Function constructor - enables code injection
Wildcards (*) allow loading from any domain - bypasses restrictions
Missing CSP provides no protection against XSS attacks

What you should see:

No CSP: All scripts execute successfully
Weak CSP: All scripts still execute (CSP allows unsafe operations)
Strong CSP: Most scripts blocked by CSP (check console for violations)