Restricting The Scripts, You're To Blame, You Give CSP A Bad Name
summary
A longitudinal scan of 10,000 sites (2012–2018) shows CSP adoption rising but script restriction rarely effective: only about one third of policies touch scripts and ~90% unsafe-inline dominates, so most sites gain no XSS protection. Level‑3 keywords like strict-dynamic and upgrade-insecure-requests appear more often, often to migrate HTTP to HTTPS. Case studies show GitHub consolidates assets to a private CDN and reaches a secure policy; Airbnb takes about three years and 33 script-src entries. Secure CSP deployment requires significant engineering and frequent misconceptions (2700 outreach, 120 replies).
AI-written summary · about
chapters (15)
- 0:00Intro
- 3:17Content Security Policy
- 11:09Script Content Control - Example
- 16:47Enforce Secure Network Connections
- 17:31How to enforce TLS via CSP
- 21:33Take Aways-TLS Enforcement
- 24:17Framing Control - X-Frame-Options
- 25:06Framing Control - Partial support
- 25:41Framing Control - Double Framing
- 26:27Framing Control - CSP frame ancestors
- 28:21Best practice for framing control
- 29:31Framing Control -XFO vs. CSP
- 30:19Framing Control - Developer Study
- 37:48Take Away Messages
- 38:47Survey Time!
related talks
43mRestricting the scripts, you're ...
32mWhat is CSP and Why Haven't You Applied it Yet
58mFixing XSS with Content Security Policy
53mI Wanna Deploy You, but My Senses Tell Me to ...
24mTowards a post-XSS world.
51mPushing CSP to PROD
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
39mRoadblocks for CSP and Where to Find Them