Restricting the scripts, you're ...
summary
A seven‑year archive study of 10,000 sites extracts Content Security Policy headers from 2012–2018 and finds only about 11% adoption by end of 2018, with level 3 rising but script‑restriction actually effective on roughly one third of policies; insecure patterns like unsafe‑inline dominate. TLS enforcement via upgrade‑insecure‑requests and framing control via frame‑ancestors are underused despite being simple. Notifications to ~2,700 x‑frame‑options sites yield 117 substantive replies; large sites take months or years to converge to secure CSPs when third‑party assets exist.
AI-written summary · about
chapters (16)
- 0:00Intro
- 3:57Cross-Site Scripting (XSS)
- 4:48Content Security Policy (CSP)
- 9:46How to go back in time?
- 10:58CSP Adoption - Level
- 14:06Script Content Control - Example
- 18:13Enforce Secure Network Connections
- 18:46How to enforce TLS via CSP
- 21:41Take Aways -TLS Enforcement
- 23:52Framing Control - X-Frame-Options
- 24:52Framing Control - Partial support
- 25:25Framing Control - Double Framing
- 26:09Framing Control - CSP frame ancestors
- 28:24Best practice for framing control
- 31:16Framing Control - Developer Study
- 40:25Take Away Messages
related talks
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
58mFixing XSS with Content Security Policy
48mAdd more protection with HTTP Security Headers
59mThe Final Frontier: Security APIs in Modern Browsers
32mWhat is CSP and Why Haven't You Applied it Yet
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
29mBrowser Security in 2017