Fixing XSS with Content Security Policy
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 11:00· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
Explains how Content Security Policy actually blocks injected script by enforcing allowed sources and by using nonce and hash directives to permit only known inline snippets, shows browser support (Firefox 31, Chrome 30 with flags, Opera lagging), gives a real adoption metric — 269 of the top 100,000 sites used CSP in 2013 and most still include unsafe-inline/unsafe-eval, demonstrates Twitter moving scripts to a single CDN subdomain successfully, and describes building/reporting tools (Yelp dashboard, Casper) that collect report-uri JSON to monitor violations.
AI-written summary · about
chapters (4)
- 0:00Start
- 45:58creating a single page application
- 50:32loading the script with the content security policy
- 57:00writing the report
related talks
24mTowards a post-XSS world.
32mWhat is CSP and Why Haven't You Applied it Yet
17mContent Security Policy: The application security Swiss Army Knife
59mThe Final Frontier: Security APIs in Modern Browsers
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
22mYou use Content Security Policy, don't you?
46mContent Security Policies: Let's Break Stuff
40mContent Security Policy to the Rescue