Content Security Policy: From newbie to advanced
summary
Explains how to build a working CSP by overriding header in Chromium to iteratively break and fix the NDC Security tickets page, adding specific host entries, hashes and nonces until functionality returns; uses Google’s CSP Evaluator to flag weaknesses and demonstrates report sample (first 40 chars) in violation payloads. Notes practical pitfalls: Google Tag Manager requires dozens of TLDs (listed ~187), report-uri vs report-to support gaps, strict-dynamic for delegated scripts, and the new PCI DSS requirement to have a CSP.
AI-written summary · about
chapters (13)
- 0:00Content Security Policy intro
- 1:56Why use CSP
- 4:02CSP basics and directives
- 8:17Enforced vs report-only
- 15:44Live CSP policy demo
- 25:06Inline scripts and styles
- 30:52Advanced CSP techniques
- 35:14Preventing XSS with CSP
- 38:05Making CSP strict
- 41:17Multiple policies pitfalls
- 42:19CSP reporting and monitoring
- 48:45How not to create CSP
- 55:10Summary and Q&A
related talks
01h 00mContent Security Policy: From newbie to advanced
40mContent Security Policy to the Rescue
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
59mThe Final Frontier: Security APIs in Modern Browsers
46mContent Security Policies: Let's Break Stuff
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
01h 01mA Successful Mess Between Hardening And Mitigation
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features