CSP 1.0 Added to Firefox to Block XSS Attacks

CSP 1.0 Added to Firefox to Block XSS Attacks:

http://threatpost.com/csp-1-0-added-to-firefox-to-block-xss-attacks/

 

thanks

 

Thanks for the share.

 

Nice, but the article forgot to state in which version it is added, but I found it:

 

I guess adding noscript, would block the xss attacks. Isn't it?
Anything benefit implementing this to the user, which does not provide by no script? I know, by default firefox would be more safer which is a very good thing.

 

Before this, NS's XSS protection was way better than Firefox's, but I don't know how it compares against FF with CSP 1.0

 

Both approaches are completely different. CSP improves server-side security (if, and only if, the Content-Security-Header is added to the website and the policy is correctly applied), while Noscript improves client-side security by filtering malicious cross-site requests. Once CSP is applied to all websites, the anti-XSS filter in Noscript is theoretically superfluous. But that's like all my Christmases have come at once if you ask me ...

BTW: A nice introduction to CSP is this one.