A Successful Mess Between Hardening And Mitigation
summary
Google reports deploying nonce-based CSP across ~62% of outgoing traffic and shows CSP mitigated ~60% of externally reported XSS in one year; on 11 very sensitive incidents 9 ran behind CSP and 7 were actually blocked. Recommendations: avoid origin whitelists, use strict-dynamic plus nonces or hashes, drop unsafe-eval when possible, and combine nonce policies with a whitelist header for defense-in-depth. Violation reports with report-sample enable detection of real exploitation attempts.
AI-written summary · about
chapters (16)
- 0:00Introduction to CSP
- 1:54Why XSS remains a threat
- 5:03Mitigation vs hardening in CSP
- 8:40CSP adoption at Google
- 13:48Why whitelist CSP fails
- 16:42Nonce-based CSP explained
- 20:24CSP levels and trade-offs
- 27:15Strict dynamic and refactoring
- 32:18Advanced CSP techniques
- 36:34Level 5 double policy
- 41:04CSP for post-XSS attacks
- 42:08CSP violation reporting
- 44:37Backward compatibility in CSP
- 46:45Effectiveness of CSP against XSS
- 47:46Summary and best practices
- 55:22Q&A session
related talks
24mTowards a post-XSS world.
32mWhat is CSP and Why Haven't You Applied it Yet
51mPushing CSP to PROD
29mNo More XSS: Deploying CSP with nonces and strict-dynamic
53mI Wanna Deploy You, but My Senses Tell Me to ...
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
01h 00mContent Security Policy: From newbie to advanced
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps