No More XSS: Deploying CSP with nonces and strict-dynamic
summary
Deploys a strict CSP using 128-bit base64 nonces plus hashes for cached pages, adds nonce-generation middleware, and rolls policy in report-only before turning it on. Uses strict-dynamic so trusted scripts can load their own dependencies instead of maintaining huge whitelists. Instapaper rollout completes in about a week; Pinterest migration is simpler on top of an existing CSP. Result: historical XSS incidents become lower-risk HTML injection; nonces have ~80% browser support, strict-dynamic still lacks IE11/Edge/Safari support.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:47Agenda
- 1:25Crosssite scripting
- 3:27Templates and autoescape
- 4:08No crosssite scripting
- 5:28Content security policy
- 6:11Domain whitelist
- 7:13Object source base URI
- 8:35HTML injection
- 11:04Inline scripts
- 12:23CSP nonces
- 13:37What can go wrong
- 14:30Hashes
- 15:44Whitelisting
- 17:46Strictdynamic
- 18:44JavaScript templates
- 19:54Deploying CSP
- 20:04Easier to deploy
- 20:34Code changes
- 21:32Nonces
- 22:33Change templates
- 23:14Report only mode
- 24:15CSP policy
- 25:23Resources
- 26:45Questions
- 28:29Report URL
related talks
32mWhat is CSP and Why Haven't You Applied it Yet
01h 01mA Successful Mess Between Hardening And Mitigation
24mTowards a post-XSS world.
58mFixing XSS with Content Security Policy
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
47mRestricting The Scripts, You're To Blame, You Give CSP A Bad Name
51mPushing CSP to PROD
53mI Wanna Deploy You, but My Senses Tell Me to ...