Towards a post-XSS world.
summary
Claim: Content Security Policy (CSP) can dramatically reduce XSS by whitelisting script/style sources and reporting violations. Implementation uses the HTTP header with directives, report-uri for violation callbacks, and mechanisms like nonces and hash whitelists to allow safe inline snippets; Chrome and Firefox implement CSP and Chrome exposes nonces behind a flag. CSP bans unsafe-eval and inline by default, supports sandboxed iframes for isolated evals, and proves practical as a deployable, incremental mitigation.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:30Cross-Site Scripting
- 2:16Malware Warning
- 3:02Content Injection Attacks
- 12:05Content Security Policy
- 12:51Content Security Policy Directive
- 14:56Report Uri
- 15:30Content Security Policy Report Only
- 16:41Csp Designed by Ignoring Reality
- 17:23Unsafe Inline
- 20:47Inject an Iframe into Your Page Sandbox
related talks
32mWhat is CSP and Why Haven't You Applied it Yet
58mFixing XSS with Content Security Policy
17mContent Security Policy: The application security Swiss Army Knife
22mYou use Content Security Policy, don't you?
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
39mProtect Your Application with the Content Security Policy HTTP Security Header
43mNo Excuses Anymore: The Demise of Cross Site Scripting
01h 01mA Successful Mess Between Hardening And Mitigation