Which HTTP header is a strong defense-in-depth layer against XSS?

Options

1. Content-Security-Policy (Correct option)
2. Access-Control-Max-Age
3. Cache-Control: max-age
4. Content-Language: en-US

Answer

Content-Security-Policy

Why

A Content-Security-Policy tells the browser which sources of scripts, styles and images are allowed, e.g. only your own domain, and can block inline scripts.

Even if an attacker manages to inject a <script> tag, the browser refuses to run it.

It is a second layer ('defense in depth'); escaping output is still the main defense.

Remember

CSP = browser allowlist for scripts. Extra layer against XSS.

Key terms

• Content-Security-Policy
• XSS (Cross-Site Scripting)
• HTTP header
• HTTP
• Defense in depth