Security/Inline Scripts and Styles: Difference between revisions

== Goals & Non-Goals ==

Cross-Site Scripting (XSS) and other content injections are a prevalent, yet very serious security issue for the web. But there is a way to make it less harmful: [https://developer.mozilla.org/en/docs/Security/CSP Content Security Policy (CSP)]. A content security policy is a list of allowed scripts, styles and other resources. Creating such a policy can disallow any kind of injected HTML to be harmful to the user. For CSP to understand which things are allowed and which are injected, everything has to live in its own document: An .html-file just for the HTML, a .css-file for stylesheets, a .js just for scripts and so on. This means, that there is quite a lot of code that requires to be rewritten.

== Identifying and changing inline code patterns ==