Difficulty: Advanced
How does CSP prevent XSS?
It informs the browser of trusted sources for scripts, styles, and other resources. It can disable inline scripts and the use of `eval()`, making most XSS attacks impossible.
XSS, Headers
JavaScript is required for the interactive version of this page, including the code playground and progress tracking. Browse all InternHack tutorials.