How HTTP Content-Security-Policy can save your romantic evening
summary
Explains how to use the HTTP Content-Security-Policy response header to protect web apps from content injection and cross-site scripting by specifying allowed sources for scripts, styles, images, and other resources. Covers practical CSP directives, how to craft policies, and how applying CSP can prevent attackers from breaking functionality that could lead to personal embarrassment or security incidents.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:50Discovering CSP
- 8:09XSS vulnerability analysis
- 10:36First blocking CSP tests
- 12:44Adding form-action self
- 13:48Trying script-src-attr
- 15:12Final solution and code changes
- 17:39Lessons learned and best practices
- 20:46Q&A
related talks
39mProtect Your Application with the Content Security Policy HTTP Security Header
32mProtecting a Service Using CSP
24mTowards a post-XSS world.
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
58mFixing XSS with Content Security Policy
17mContent Security Policy: The application security Swiss Army Knife
32mWhat is CSP and Why Haven't You Applied it Yet
40mContent Security Policy to the Rescue