Defeating Cross-Site Scripting with Content Security Policy (updated)

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Defeating cross-site scripting
with Content Security Policy

François Marier – @fmarier

what is a cross-site scripting
(aka “XSS”) attack?

preventing XSS attacks

print <<<EOF
<html>

<h1>$title</h1>

</html>
EOF;

$title = escape($title);

print <<<EOF
<html>

<h1>$title</h1>

</html>
EOF;

templating system

page.tpl:

<html>
<h1>{title}</h1>
</html>

page.php:

render(“page.tpl”, $title);

auto-escaping turned ON

page.tpl:

<html>
<h1>{title|raw}</h1>
</html>

page.php:

render(“page.tpl”, $title);

auto-escaping turned ON

escaping always ON

the real problem:

browser default = allow all

a way to get the browser
to enforce the restrictions
you want on your site

$ curl --head http://example.com/

Content-Security-Policy:
default-src 'self' ;
img-src 'self' data ;

$ curl --head https://example.com/login

Content-Security-Policy:
default-src 'self' ;
img-src 'self' data ;
fr...

$ curl --head http://fmarier.org/

Content-Security-Policy:
default-src 'none' ;
img-src 'self' ;
style-src 'se...

<object>, <applet> & <embed>
<script>
<style> & <link>
<img>
<audio>, <...

>= 10

what does a CSP-enabled
website look like?

unless explicitly allowed by your policy

inline scripts are not executed

unless explicitly allowed by your policy

external resources are not loaded

preparing your website for CSP
(aka things you can do today)

eliminate inline scripts and styles

<script>
do_stuff();
</script>

<script src=”do_stuff.js”>

</script>

eliminate javascript: URIs

<a href=”javascript:go()”>
Go!
</a>

<a id=”go-button” href=”#”>
Go!
</a>
var button =
document.getElementById('go-button');
button.onclick = go;

rolling out CSP

start with a loose policy

default-src 'self' *.example.com data;

default-src 'self' *.example.com data;

options unsafe-inline

work towards a stricter policy

default-src 'self';

img-src 'self' static.example.com data;

style-src static.example.com;

script-src static.example.com

use the reporting mode

Content-Security-Policy-Report-Only:
default-src 'none' ;
report-uri http://example.com/report.cgi

{

"csp-report": {

"document-uri": "http://example.com/page.html",

"referrer": "http://evil.example....

add headers in web server config

<Location /some/page>

Header set Content-Security-Policy
"default-src 'self' ;
script-src 'self' http://example.o...

not a
replacement
for proper
XSS hygiene

great tool to
increase the
depth of
your defenses

Spec:
http://www.w3.org/TR/CSP/

HOWTO:
https://developer.mozilla.org/en/Security/CSP

@fmarier ...

100 %
FREE!

bonus
HTTP header

wouldn't it be nice if the browser...

...blocked all HTTP requests there?

HTTP Strict
Transport Security

$ curl --head https://login.persona.org

HTTP/1.1 200 OK
Vary: Accept-Encoding,Accept-Language
Cache-Control: public, max-...

HTTPS only site turn HSTS on

Spec:
http://www.w3.org/TR/CSP/
https://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec

HOWTO:
https://devel...

Photo credits:
Biohazard wallpaper: http://www.flickr.com/photos/rockyx/4273385120/

Under Construction: https://secure.fl...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Reign Seven Nine; Web Designing Ind... by Raincheck Network... 822 views
Megha india ppt by loveunona 558 views
Global Software Solutions by Shray Jali 624 views
Hacking Client Side Insecurities by amiable_indian 2490 views
Cisco IOS Attack & Defense - The St... by amiable_indian 3214 views
Workshop on Wireless Security by amiable_indian 3546 views

View on Slideshare

1 of 62 Ad

View on Slideshare

1 of 62 Ad