tworthy places.

How websites tell browsers which code source is trustworthy is achieved using a security mechanism

called Content Security Policy $($CSP$).$ This mechanism is specifically designed to defeat XSS and ClickJacking attacks. It has become a standard, which is supported by most browsers nowadays. CSP not only

restricts JavaScript code, it also restricts other page contents, such as limiting where pictures, audio, and

video can come from, as well as restricting whether a page can be put inside an iframe or not $($used for

defeating ClickJacking attacks$).$ Here, we will only focus on how to use CSP to defeat XSS attacks.