CSP XXP STS PKP CAA ETC OMG WTF BBQ…
summary
Content Security Policy stops injected scripts (demo: browser refuses evil.com/keylogger and blocks inline code), supports CSP report-only with report-uri that posts JSON violation payloads for real-time QA, and can enforce form-action and upgrade-insecure-requests to rewrite HTTP assets. XSS Protection (X-XSS-Protection) offers modes enabled / mode=block / report, where block prevents auditor tampering. HSTS forces HTTPS (use low max-age to test; Facebook used 10s initially). Public Key Pinning is high-risk; use CAA DNS records and Certificate Transparency instead.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:23Content Security Policy
- 5:00Script Sauce
- 7:56Form Actions
- 14:16Demonstrations
- 19:50XXP
- 23:08In Action
- 27:53STS
- 37:43PKP
- 42:13Report only mode
- 44:33Less Encrypt
- 46:11DNS Record
- 51:43Overview
- 52:01Explicit
- 52:29HTTP
- 52:52Dark HTTPS
- 53:21Certificate Transparency
- 53:58Summary
related talks
32mWhat is CSP and Why Haven't You Applied it Yet
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
24mTowards a post-XSS world.
58mFixing XSS with Content Security Policy
22mYou use Content Security Policy, don't you?
17mContent Security Policy: The application security Swiss Army Knife
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
29mNo More XSS: Deploying CSP with nonces and strict-dynamic