CSP: Content Security Policy for EUDI Wallet Web Security

Content Security Policy (CSP) is a security standard implemented via HTTP headers that defines which content sources are allowed on a web page. CSP prevents cross-site scripting (XSS), clickjacking, and other code injection attacks by whitelisting trusted content origins. For EUDI Wallet web applications, CSP is a mandatory security control that protects credential verification portals and wallet management interfaces.

CSP works by adding an HTTP response header (Content-Security-Policy) to web pages served by the EUDI Wallet web application. This header contains a policy string composed of directives, each controlling a specific type of resource. When the browser loads the page, it parses the CSP header and enforces the policy for all subsequent resource loads and script executions.

For example, if the policy specifies script-src 'self', the browser will only execute JavaScript files loaded from the same origin as the page. Any attempt to execute an inline script, load a script from a different domain, or use eval() will be blocked. This is the primary defense against XSS attacks, where an attacker injects malicious scripts into web pages.

CSP operates on a whitelist model -- everything is blocked unless explicitly allowed. This is fundamentally more secure than a blacklist approach, as it protects against unknown attack vectors. New attack techniques that rely on loading resources from external domains are automatically blocked if those domains are not whitelisted.

EUDI Wallet web portals handle sensitive operations: credential presentation requests, identity verification flows, and consent management interfaces. A strong CSP implementation for these portals typically includes:

• •Strict script control: script-src 'self' with nonce-based exceptions for necessary inline scripts. This blocks all unauthorized JavaScript execution while allowing the application own scripts to function.
• •API connection restrictions: connect-src limiting XMLHttpRequest and fetch calls to authorized EUDI Wallet API endpoints only.
• •Frame protection: frame-ancestors 'none' preventing the wallet interface from being embedded in malicious sites for clickjacking attacks.
• •Form action control: form-action 'self' ensuring credential data can only be submitted to the application own endpoints.

CSP is one layer in a defense-in-depth security strategy for EUDI Wallet web services. It works alongside other security headers and mechanisms:

• •HSTS (HTTP Strict Transport Security): Ensures all connections use HTTPS, preventing protocol downgrade attacks.
• •CORS: Controls which external domains can make API requests to wallet services.
• •CSRF tokens: Prevent cross-site request forgery attacks on wallet management operations.
• •Subresource Integrity (SRI): Ensures CDN-hosted scripts have not been tampered with by verifying their cryptographic hash.

Together, these mechanisms create multiple barriers that an attacker must overcome, significantly reducing the risk of successful web-based attacks against EUDI Wallet infrastructure.