Content Security Policy
•
0 likes•2,624 views
CSP is a security policy that helps prevent cross-site scripting attacks by whitelisting sources of approved scripts, styles, fonts, and other assets. It works by delivering a policy via HTTP headers that specifies allowed/blocked content. The policy uses directives like script-src, style-src, and font-src to control which elements can load assets from various sources like self, unsafe-inline, or specific domains. Implementing CSP involves starting with a restrictive policy and gradually expanding allowed sources as needed while balancing security and functionality.
Report
Share
Content Security Policy
- 4. HOLYARCHERS
- 6. Thinking about a new side-project
- 7. Fire up `ember new`
- 8. (wait on NPM and Bower)
- 11. But wait!?!?
- 13. What is Content Security Policy?
- 14. XSS Mitigation Strategy using a whitelist based approach.
- 15. What is XSS? people trying to execute malicious (usually?) javascripts on your page.
- 16. How CSP helps? deliver policy via http header with information about what is allowed to execute on your site.
- 17. When we request a webpage, we get a response that has a header and a body CSP in the wild
- 18. Response body (has the html/css/js)
- 19. Response Header has (various meta-data)
- 20. CSP in the wild
- 21. How to implement and customize CSP
- 23. default-src script-src*** object-src style-src img-src media-src frame-src font-src connect-src (script-src key directive for blocking scripting)
- 25. script-src <script> object-src <object>, <embed> style-src <link rel=“stylesheet”>, <style> img-src <img>, images in css media-src <audio>, <video> frame-src <iframe>, <frame> font-src @font-face connect-src XMLHttpRequest, JS APIs
- 27. Space delimited sources to match http header syntax semi colon end of line About the Values
- 28. self Anything you’re including locally
- 29. unsafe-inline Anything happening by your content Better to “separate code and data” This includes inline event handlers
- 30. unsafe-eval setTimeout eval not as big a deal as unsafe inline
- 31. Custom Templates Not executing. No problem.
- 32. Other Values *— Anything Goes none— Nothing Goes url— can specify ports, protocols, wildcards, etc http://content-security-policy.com/
- 34. Serve nothing at all
- 36. Only serve local assets … a good starting spot
- 37. Build up slowly as needed
- 38. Focus on script-src …especially if you’re worried mostly about XSS
- 39. mitigate XSS …a more complete plan * move inline script out-of-line * remove inline event handlers * Remove use of eval and friends (not as big) * Add the script-src directive
- 40. Report only, callback url, block Options for Enforcing
- 41. Wanna try it out? Try report only mode and tweak as you go