Pushing CSP to PROD

on YouTube ↗51m

" summary

Case study of deploying a strict CSP on SendSafely.com: team sets default-src 'none', moves all JS to static.sendsafely.com, strips inline handlers to event listeners and data-attributes, hosts jQuery locally and negotiates reCAPTCHA changes with Google. Built a violation reporting endpoint and servlet filter for browser-specific headers; reports flood in from extensions (LastPass/analytics), creating surprising noise. CSP reduces XSS risk in practice but hits quirks: web workers require same origin, Java applet bypass in browsers, and reporting formats vary by browser.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 3:22Browser Support for CSP
3. 6:58About the Application
4. 13:15Eliminating In-line Scripting (Example #2)
5. 16:09Working with Third Party Scripts . We try to minimize reliance on third party scripts - Occasionally the cost/benefit is worth using them
6. 19:20Refactoring reCAPTCHA (Example #1)
7. 33:48Example CSP Error Report
8. 35:55Real CSP Error Report from Production
9. 37:48The (big) problem with False Positives
10. 43:26Maximizing Browser Coverage
11. 46:52Other Notable Differences • Safari posts CSP Error Reports

" related talks

• 32mWhat is CSP and Why Haven't You Applied it YetJoel Weinberger · AppSec California 2014
• 47mRestricting The Scripts, You're To Blame, You Give CSP A Bad NameSebastian Roth, Ben Stock · OWASP Global AppSec Amsterdam 2019
• 24mTowards a post-XSS world.Mike West · JSConf EU 2013
• 01h 01mA Successful Mess Between Hardening And MitigationSpagnuolo, Weichselbaum · HITBSecConf 2019 Amsterdam
• 53mI Wanna Deploy You, but My Senses Tell Me to ...Sebastian Roth, Ben Stock · RuhrSec Day 2022
• 39mRoadblocks for CSP and Where to Find ThemSebastian Roth · Global AppSec US 2021 Virtual
• 01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…Scott Helme · NDC London 2018
• 29mNo More XSS: Deploying CSP with nonces and strict-dynamicDevin Lundberg · BSidesSF 2018