Content Security Policies: Let's Break Stuff
summary
Explains how Content Security Policy actually works: it blocks injected scripts (LastPass script-injection example), caused a production rollout to break until report-only mode and reporting were used, and uses cryptographic nonces to allow trusted inline scripts. Live failure reports go to Report URI instead of building a dashboard. Cites concrete risks (XSS major vector), the need to iterate policies, and an incident where misconfigured CSP reporting generated ~45,000 requests/sec and overloaded the collector.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:58Break production sites with incorrectly configured content security policies
- 1:33THE SCARY STUFF
- 2:58Of those browser based vulnerabilities, 86% were found to be XSS related
- 6:08HACKERS ASSAULT EPILEPSY PATIENTS VIA COMPUTER
- 10:47HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS
- 11:57DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD
- 12:54BLOCKING THOSE PESKY CRYPTO-MINING SCRIPTS THAT HAVE BEEN POPPING UP
- 13:47BROWSER SUPPORT
- 18:44DON'T USE UNSAFE- INLINE
- 21:30I BROKE PRODUCTION WITH A BAD CSP
- 21:48DON'T DO WHAT I DID
- 23:45WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
- 25:00REPORT-URI.IO
- 28:01TRIAL STUFF BEFORE ENFORCING
- 31:10Write a helper in your template engine to generate script tags with a nonce if it's available
- 42:28DEMO TIME! LET'S BREAK STUFF
related talks
17mContent Security Policy: The application security Swiss Army Knife
32mWhat is CSP and Why Haven't You Applied it Yet
58mFixing XSS with Content Security Policy
40mContent Security Policy to the Rescue
01h 00mContent Security Policy: From newbie to advanced
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
22mYou use Content Security Policy, don't you?
24mTowards a post-XSS world.