Content Security Policy: From newbie to advanced
summary
CSP basics plus a live walkthrough that builds a working policy using Chrome DevTools header override, iteratively fixing ~108 then ~146 violations down to two by adding directives and hashes and media/image/connect hosts. Shows practical tooling: copying script hashes, using the integrity attribute to get hashes, and validating with CSP Evaluator. Flags real-world pitfalls: Google Tag Manager needs ~74 top‑level domains (~350 sources if duplicated), report endpoints (report‑uri / report‑to), and how lax policies (example with unsafe‑inline/unsafe‑eval) leave pages effectively unprotected; recommends nonces and hashes.
AI-written summary · about
chapters (15)
- 0:00Introduction to CSP
- 1:52Understanding CSP basics
- 4:07Policy development demo
- 7:55Directives and sources
- 11:57Advanced policy configuration
- 14:07Refining policies in the browser
- 17:46Handling third-party scripts
- 21:35Wildcards and policy evaluation
- 27:29Hashes and nonces for scripts
- 32:22Strict dynamic and security
- 34:28Best practices and common pitfalls
- 42:31Security headers and relations
- 44:59Policy reporting
- 45:37Case study and troubleshooting
- 57:08Q&A and closing
related talks
01h 00mContent Security Policy: From newbie to advanced
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
40mContent Security Policy to the Rescue
58mFixing XSS with Content Security Policy
46mContent Security Policies: Let's Break Stuff
59mThe Final Frontier: Security APIs in Modern Browsers
24mTowards a post-XSS world.
32mWhat is CSP and Why Haven't You Applied it Yet