What is CSP and Why Haven't You Applied it Yet
Talkat AppSec California 2014 · on Tuesday, 2014-01-28· at 11:30· Track 3, Annenberg Community Beach House, East Pacific Coast Highway·
summary
Content Security Policy claims to block most XSS by enforcing a whitelist of resource origins, forbidding inline scripts and eval, and returning violations to a specified endpoint so operators see attacks as JSON. Major sites (Twitter Facebook Etsy Github) deploy it; teams use report-only header first, collect report-uri JSON, then tighten policies. Inline scripts remain the main rollout pain but script hashes and nonces and framework tools (Rails gem, auto-hash generators) make phased deployment practical; browser bugs are the primary bypass.
AI-written summary · about
chapters (7)
- 0:00Start
- 13:243 Reasons CSP Is Awesome
- 15:52Rolling Out CSP In The Real World
- 17:06Potential Difficulties
- 18:41You Are Not Alone
- 19:15Read This Thread
- 20:07Extra Non-Boss Bonus
related talks
24mTowards a post-XSS world.
58mFixing XSS with Content Security Policy
17mContent Security Policy: The application security Swiss Army Knife
22mYou use Content Security Policy, don't you?
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
46mContent Security Policies: Let's Break Stuff
39mProtect Your Application with the Content Security Policy HTTP Security Header