Microsoft announces support for Content Security Policy Level 2 (CSP2) in Microsoft Edge
1 min. read
Published on
Share this article
Improve this guide
Read our disclosure page to find out how can you help MSPoweruser sustain the editorial team Read more
With the latest Windows 10 Creators Update Insider build, Microsoft has included support for Content Security Policy Level 2 (CSP2) in Microsoft Edge (EdgeHTML 15.15002) to make it the safest and most secure browser. CSP2 is an effective defense-in-depth mechanism against cross site scripting and content injection attacks.
CSP allowed web developers to lock down the resources that can be used by their web application, helping prevent cross-site scripting attacks that remain a common vulnerability on the web. But it was difficult to implement on websites with inline script elements that either pointed to script sources or that contained script directly.
CSP2 makes these scenarios easier by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value generated on each page load that appears in both the CSP policy and in the script tags in the page. Using nonces can help to minimize maintaining a list of allowed source URL values, while also allowing trusted script declared in script elements to run.
In future, Microsoft is also planning to add support for strict-dynamic from the CSP3 spec to enable developers and site administrators to reduce their reliance on whitelists and tighten their CSP implementations.
