🚨 Content Security Policy (CSP) Demonstration

⚠️ Current CSP Mode: STRONG

CSP Header: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'

Description: Strong CSP - blocks most XSS attempts

Test Different CSP Configurations:

XSS Test Buttons (click to test CSP effectiveness):

External Resource Tests:

Try loading external JavaScript:

CSP Vulnerability Analysis:

'unsafe-inline' allows inline scripts and styles - defeats XSS protection
'unsafe-eval' allows eval(), Function constructor - enables code injection
Wildcards (*) allow loading from any domain - bypasses restrictions
Missing CSP provides no protection against XSS attacks

What you should see:

No CSP: All scripts execute successfully
Weak CSP: All scripts still execute (CSP allows unsafe operations)
Strong CSP: Most scripts blocked by CSP (check console for violations)