Published at LXer:

In an article on its security blog, the Mozilla Foundation has presented a new security policy – known as content security policy (CSP) – intended to guard against the epidemic of cross-site scripting attacks (XSS) and other vulnerabilities. This allows web administrators, by sending special headers, to tell the browser which domains it should accept as sources for trusted code. Standard XSS attacks sometimes utilise vulnerabilities in web applications in order to execute JavaScript in the browser with the rights of trusted domains.

Read More...