Question

A successful cross-site scripting (XSS) attack

against a Web application could result in a violation of which policies?

Which mechanisms are defeated?

Answer 1

A successful cross-site scripting (XSS) attack against a Web application could result in a violation of the Content Security Policy (CSP), HSTS policy, and Violation Report policies. CSP was primarily designed to prevent XSS attacks, therefore enabling inline JavaScript execution compromises the protection it offers. XSS attack steals a user’s cookie and sends it to an adversary. A CSP provides security controls to tackle cross-site scripting (XSS) attacks carried out introducing malicious or otherwise undesirable content into a web application.

Violation Report Policy is meant for the web browser to source content from the original domain name being requested and accessed. Violating this policy, the web browser will submit a violation report to the web application domain.

The mechanisms defeated are:
* Cookie security enhancements: XSS attack explore and thoroughly make use of web applications' dependencies on session IDs to disguise as a legitimate user and hijack the user's session. The protection mechanism to safeguard cookies containing session IDs for the security of web applications is defeated. It defeats the CSP's whitelisting of content sources definition, violation report directives and changes to the default CSP restrictions such as inline JavaScript mechanisms.

It defeats the configuration mechanism of the web server that included the CSP HTTP header in all HTTP responses. Other mechanisms defeated are:
* Allow own domain only.
* Allow subdomains.
* Restrict to self, allow inline JavaScript.
* Allow everything from anywhere but block third-party scripts.
* Allow to self and authorized external sources.
* Force all requests over HTTPS.
* Violation Report Policy.

It also defeats, HTTP Strict Transport Security (HSTS) policy: This mechanism for a web application requires configuring the associated web server to include the HSTS header in all HTTPS responses.