Add Countersignature Security Employment Application with airSlate SignNow

Add countersignature Security Employment Application

now what is going on guys today we are going to talk about content security policy what it is why you need it and how you might use it in your own application so the main reason why content security policy exists is that we want to protect ourselves against cross-site scripting i just want to explain cross-site scripting with one very specific type of cross-site scripting so cross-site scripting is always uh like abbreviated with xss what i want to demonstrate or to explain is like stored cross-site scripting so let's make a practical example let's say you were on youtube and you were scrolling through the comments uh maybe through the comments of this video let's imagine like normally people put text in the comments right something ah nice video or they have like a question they ask something that's all cool but literally anyone can write a comment on youtube right so let's say you're a hacker then you could put something like this so you instead of putting like a text you could put an html tag which is attempting to load like some script from your website and this is especially this is very dangerous because if you save this comment then like the server is going to store it in the database for everyone who is scrolling through the comments like afterwards this text here will be loaded yeah and that itself would not be a problem if the text you put here is actually treated as text and not as html but just as it happens oftentimes you know we're all just human we just forget about it so if you by accident say okay the inner html of this div is the text and you just say oh yeah people are just going to put the text then you have a big security vulnerability because what this means is that once this comment here is posted and stored in the database everyone who's going to scroll through the comments after that will have this additional html tag in your website and all of a sudden everyone who's watching this video everyone who gets on that page the browser will just load like this script from this origin and the script will execute you do evil things and that's why this thing is called a cross-site scripting so basically the idea is that some attacker is able to inject some script into another person's browser or the hacker can do so by exploiting the belief that everything that comes from your own server is kind of safe and what i've just shown here is a special type of cross-site scripting which is called the stored cross-site scripting simply because the attack is actually stored in the database so there's also other types of cross-site scripting uh reflected cross-set scripting dom based cross-site scripting but i think this one is like the easiest variant to understand okay and what we want to do with...