I Wanna Deploy You, but My Senses Tell Me to ...
summary
Analysis of ~10,000 sites over 12 weeks shows CSP adoption rises but is often ineffective: 95% meaningless (unsafe-inline, data: URIs or open https wildcards). Third parties force failures—6,000 of 8,000 blocked from deployable CSPs mostly via inline event handlers—and 5,400 sites see new ETLD+1 origins added during the study. A 12-developer interview study confirms tool and browser inconsistencies. Recommended tactics that worked in practice: deploy report-only, add nonces/strict-dynamic where possible, externalize inline code, self‑host libs, and harden with a secondary host‑based policy.
AI-written summary · about
chapters (10)
- 0:00CSP introduction
- 3:57CSP pitfalls and evolution
- 11:17CSP compatibility challenges
- 13:47Third-party CSP roadblocks
- 24:07Developer CSP experiences
- 34:36Mitigating CSP issues
- 41:09Why CSP fails
- 47:16Hardening CSP policies
- 50:25Trusted Types research
- 52:09Key takeaways
related talks
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
39mRoadblocks for CSP and Where to Find Them
01h 01mA Successful Mess Between Hardening And Mitigation
51mPushing CSP to PROD
32mWhat is CSP and Why Haven't You Applied it Yet
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
43mRestricting the scripts, you're ...
40mContent Security Policy to the Rescue