Caspr and Friends

on YouTube ↗51m

" summary

Caspr is an open source Heroku-hosted service that collects and normalizes CSP reports and aggregates duplicates into groups, uses those JSON violation reports to generate candidate policies, and exposes a REST API and dashboard. The demo shows a Chrome extension Enforcer for testing policies and a csp-tools suite for command‑line work. Deployment runs on Heroku, scales to about 30,000 reports before strain, and the workflow produces usable policy suggestions that actually reduce violations.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:49Content Security Policy Reporting
3. 3:23Cross-Site Scripting
4. 7:15Script Source
5. 8:35Form Action
6. 9:35Director Values
7. 17:45Hide a Query String
8. 29:37Group Reports into Buckets
9. 30:17Image Source
10. 30:58Policy Builder
11. 37:22Filters
12. 39:36Csp Storm
13. 39:48Csp Endpoint
14. 40:19Csp Filtering
15. 43:12Change Policy per Request

" related talks

• 51mPushing CSP to PRODBrian Holyfield, Erik Larsson · AppSecUSA 2013
• 32mWhat is CSP and Why Haven't You Applied it YetJoel Weinberger · AppSec California 2014
• 31mCCSP: Controlled Relaxation of Content Security Policies...Stefano Calzavara, Alvise Rabitti, Michele Bugliesi · 26th USENIX Security Symposium (USENIX Security '17)
• 01h 00mContent Security Policy: From newbie to advancedHalvor Sakshaug · NDC Oslo 2025
• 46mContent Security Policies: Let's Break StuffMatt Brunt · Dutch PHP Conference 2018
• 39mRoadblocks for CSP and Where to Find ThemSebastian Roth · Global AppSec US 2021 Virtual
• 42mDeploying and managing CSP: the browser-side firewallLavakumar Kuppan · Rootconf 2019
• 47mRestricting The Scripts, You're To Blame, You Give CSP A Bad NameSebastian Roth, Ben Stock · OWASP Global AppSec Amsterdam 2019