Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (13)
Similar to Defeating Cross-Site Scripting with Content Security Policy
Similar to Defeating Cross-Site Scripting with Content Security Policy (20)
More from Francois Marier
More from Francois Marier (20)
Recently uploaded
Recently uploaded (20)
Defeating Cross-Site Scripting with Content Security Policy
- 1. Defeating cross-site scripting with Content Security Policy Francois Marier <francois@catalyst.net.nz>
- 2. what is a cross-site scripting (aka “XSS”) attack?
- 9. $title = escape($title); print <<<EOF <html> <h1>$title</h1> </html> EOF;
- 11. page.tpl: <html> <h1>{title}</h1> </html> page.php: render(“page.tpl”, $title);
- 13. page.tpl: <html> <h1>{title|raw}</h1> </html> page.php: render(“page.tpl”, $title);
- 14. auto-escaping turned ON != escaping always ON
- 15. the real problem: browser default = allow all
- 17. a way to get the browser to enforce the restrictions you want on your site
- 18. $ curl --head https://www.libravatar.org/ X-Content-Security-Policy: default-src 'self' ; img-src 'self' data
- 19. $ curl --head https://www.libravatar.org/account/login/ X-Content-Security-Policy: default-src 'self' ; img-src 'self' data ; frame-src 'self' https://browserid.org ; script-src 'self' https://browserid.org
- 20. $ curl --head http://fmarier.org/ X-Content-Security-Policy: default-src 'none' ; img-src 'self' ; style-src 'self' ; font-src 'self'
- 21. <object> <script> <style> <img> <audio> & <video> <frame> & <iframe> <font> WebSocket & XMLHttpRequest
- 22. >= 4 >= 13 >= 5 >= 10
- 23. what does a CSP-enabled website look like?
- 26. unless explicitly allowed by your policy inline scripts are not executed
- 29. unless explicitly allowed by your policy external resources are not loaded
- 30. preparing your website for CSP (aka things you can do today)
- 31. eliminate inline scripts and styles
- 36. <a id=”go-button” href=”#”> Go! </a> var button = document.getElementById('go-button'); button.onclick = go;
- 37. add headers in web server config
- 38. <Location /some/page> Header set X-Content-Security-Policy "default-src 'self' ; script-src 'self' http://example.org" </Location>
- 39. not a replacement for proper XSS hygiene
- 40. great tool to increase the depth of your defenses
- 41. Spec: http://www.w3.org/TR/CSP/ HOWTO: https://developer.mozilla.org/en/Security/CSP fmarier fmarier Copyright © 2012 François Marier Released under the terms of the Creative Commons Attribution Share Alike 3.0 Unported Licence
- 42. Credits: Biohazard wallpaper: http://www.flickr.com/photos/rockyx/4273385120/ Under Construction: https://secure.flickr.com/photos/aguichard/6864586905/