Downloaded 23 times
More Related Content
Similar to Defeating Cross-Site Scripting with Content Security Policy (updated)
![Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/apachesparkgettingstarted-260203175547-8361bcc3-thumbnail.jpg?width=640&height=640&fit=bounds)
Defeating Cross-Site Scripting with Content Security Policy (updated)
- 1. Defeating cross-site scripting with Content Security Policy François Marier – @fmarier
- 2. what is across-site scripting (aka “XSS”) attack?
- 7.
- 8.
- 9. $title = escape($title); print<<<EOF <html> <h1>$title</h1> </html> EOF;
- 10.
- 11. page.tpl: <html> <h1>{title}</h1> </html> page.php: render(“page.tpl”, $title);
- 12.
- 13. page.tpl: <html> <h1>{title|raw}</h1> </html> page.php: render(“page.tpl”, $title);
- 14. auto-escaping turned ON escaping always ON
- 15. the real problem: browserdefault = allow all
- 17. a way toget the browser to enforce the restrictions you want on your site
- 18. $ curl --headhttp://example.com/ Content-Security-Policy: default-src 'self' ; img-src 'self' data ;
- 19. $ curl --headhttps://example.com/login Content-Security-Policy: default-src 'self' ; img-src 'self' data ; frame-src 'self' https://login.persona.org ; script-src 'self' https://login.persona.org
- 20. $ curl --headhttp://fmarier.org/ Content-Security-Policy: default-src 'none' ; img-src 'self' ; style-src 'self' ; font-src 'self'
- 21. <object>, <applet> &<embed> <script> <style> & <link> <img> <audio>, <video>, <source> & <track> <frame> & <iframe> @font-face WebSocket, EventSource, & XMLHttpRequest
- 22.
- 23. what does aCSP-enabled website look like?
- 26. unless explicitly allowedby your policy inline scripts are not executed
- 29. unless explicitly allowedby your policy external resources are not loaded
- 30. preparing your websitefor CSP (aka things you can do today)
- 31. eliminate inline scriptsand styles
- 32.
- 33.
- 34.
- 35.
- 36. <a id=”go-button” href=”#”> Go! </a> varbutton = document.getElementById('go-button'); button.onclick = go;
- 37.
- 38. start with aloose policy
- 39.
- 40. default-src 'self' *.example.comdata; options unsafe-inline
- 41. work towards astricter policy
- 42. default-src 'self'; img-src 'self'static.example.com data; style-src static.example.com; script-src static.example.com
- 43.
- 44. Content-Security-Policy-Report-Only: default-src'none' ; report-uri http://example.com/report.cgi
- 45. { "csp-report": { "document-uri": "http://example.com/page.html", "referrer": "http://evil.example.com/haxor.html", "blocked-uri": "http://evil.example.com/foo.png", "violated-directive": "default-src 'none'", "original-policy": "default-src 'none' ... " } }
- 46. add headers inweb server config
- 47. <Location /some/page> Headerset Content-Security-Policy "default-src 'self' ; script-src 'self' http://example.org" </Location>
- 48. not a replacement forproper XSS hygiene
- 49. great tool to increase the depth of your defenses
- 50.
- 51. 100 % FREE! bonus HTTP header
- 55. wouldn't it benice if the browser...
- 56. ...blocked all HTTPrequests there?
- 57.
- 58. $ curl --headhttps://login.persona.org HTTP/1.1 200 OK Vary: Accept-Encoding,Accept-Language Cache-Control: public, max-age=0 Content-Type: text/html; charset=utf8 Strict-Transport-Security: max-age= 2592000 Date: Thu, 16 Aug 2012 03:29:19 GMT ETag: "2943768d6a45793897e83bf8804cd711" Connection: keep-alive X-Frame-Options: DENY Content-Length: 5374
- 60. HTTPS only site turn HSTS on
- 61.
- 62. Photo credits: Biohazard wallpaper:http://www.flickr.com/photos/rockyx/4273385120/ Under Construction: https://secure.flickr.com/photos/aguichard/6864586905/ Castle walls: https://secure.flickr.com/photos/rdale/585105348/ Wash hands: https://secure.flickr.com/photos/hygienematters/4504612019/ Copyright © 2012 François Marier Released under the terms of the Creative Commons Attribution Share Alike 3.0 Unported Licence