CCSP: Controlled Relaxation of Content Security Policies...
summary
Proposes CCSP, a runtime policy composition that lets embedded scripts supply whitelists while the page keeps an upper bound via a CSP intersect header and an initial policy via a CSP compose header. Claims backward compatibility and low deployment cost, implements a Chrome extension prototype, and tests it on major sites (fixing violations on twitter.com and orange.sk). Empirical scan finds 96% of dependency violations come from scripts that load other scripts, and prototype evaluation shows the approach is practicable.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:15Web security is hard to get right!
- 1:43Content Injection (1/2)
- 3:27Content Security Policy (CSP)
- 4:39Example CSP
- 5:30Problems with CSP
- 7:27Compositional CSP (CCSP)
- 8:45Running Example
- 9:15Example - Classic CSP (CSP 1 or 2)
- 14:06Example - CCSP (2/2)
- 17:23Analysis of CCSP
- 19:29Design Evaluation
- 23:02Testing CCSP in the wild
- 24:37The evolution of CSP
- 25:16Conclusion
related talks
24mTowards a post-XSS world.
32mWhat is CSP and Why Haven't You Applied it Yet
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
01h 00mContent Security Policy: From newbie to advanced
46mContent Security Policies: Let's Break Stuff
32mProtecting a Service Using CSP
58mFixing XSS with Content Security Policy