When reading about XSS and the Content Security Policy (CSP) everything sounds like it is important to watch out and take care if there is user generated content which is visible to other users, like through postings or comments. In case of a website where the user can't save self generated content - is it still important to set CSP up for other reasons / possible flaws?
1 Answers
Firstly, it defends against situations where you did not think user content could get executed as part of your HTML.
Secondly, third-party JavaScript could cause unwanted page loads.
I’d put it in anyway. It does no harm to restrict loads from places you didn’t want to load from anyway.
Related