Scripting attack detection and mitigation using content security policy violation reports

Abstract

Certain aspects of the present disclosure provide techniques for Scripting attack detection and mitigation. A method generally includes receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to second web application(s); identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations; classifying the first violation and the one or more second violations as a first scripting attack based on the first plurality of features and the second pluralities of features; and based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the first scripting attack on the first web application and the second web application(s).