Content Security Policy to the Rescue
summary
Shows a live demo of an intentionally vulnerable app including a crypto‑jacking example that claims ~4,000 sites were hit recently and demonstrates CSP blocking injected scripts. Covers concrete mitigations like nonce and hash deployment, strict‑dynamic behavior, report‑only migration with reporturi.com, and directives for clickjacking (frame‑ancestors) and HTTPS migration (upgrade‑insecure‑requests). Demos sometimes hiccup but the talk gives actionable header syntax, common bypasses to watch for, and practical notes on rollout and maintenance.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:03CONTENT SECURITY POLICY TO THE RESCUE
- 1:03ABOUT ME
- 10:01MITIGATIONS
- 12:22WHAT IS CSP?
- 14:47ADDING THE SECURITY HEADER
- 15:13SELF
- 16:03CSP DIRECTIVES
- 19:00SAMPLE POLICY
- 19:52BAD IDEAS
- 20:29FIXING INLINE SCRIPTS
- 21:19HASH
- 23:46STRICT-DYNAMIC
- 27:17MITIGATING XSS
- 27:59BREAKING STUFF
- 28:56REPORTING
- 29:48HTTPS MIGRATION
- 33:46X-FRAME-OPTIONS
- 36:07PREVENTING CLICKJACKING USING CSP
related talks
01h 00mContent Security Policy: From newbie to advanced
46mContent Security Policies: Let's Break Stuff
58mFixing XSS with Content Security Policy
32mWhat is CSP and Why Haven't You Applied it Yet
55mWeb Application Security: Browsers Fight Back!
01h 00mContent Security Policy: From newbie to advanced
22mYou use Content Security Policy, don't you?
59mThe Final Frontier: Security APIs in Modern Browsers