Using Content Security Policy for Privacy

on YouTube ↗10m

" summary

Pinterest uses Content Security Policy to block any network requests to domains not on an allow list, creating a centralized schema in the code repo that gives full inventory of third‑party SDKs and gates onboarding by alerting privacy and legal. Deployment uses report-only mode with report URI query parameters and gradual rollout percentages, implements per-consent policies and multiple CSP headers to handle nonces, and documents pitfalls: nonces override host allow lists, iframes bypass CSP, JavaScript integrations are high risk, and older Safari needs special handling.

AI-written summary · about

" chapters (9)

1. 0:00CSP for privacy intro
2. 1:13Third-party data sharing importance
3. 2:35How CSP works
4. 3:40CSP benefits beyond security
5. 4:23Dynamic CSP for consent
6. 5:27Deploying CSP step by step
7. 7:15Nonces and hashes in CSP
8. 8:19High-risk third-party assets
9. 9:23CSP limitations and checks

" related talks

• 32mWhat is CSP and Why Haven't You Applied it YetJoel Weinberger · AppSec California 2014
• 17mContent Security Policy: The application security Swiss Army KnifeScott Helme · dotSecurity 2016
• 46mContent Security Policies: Let's Break StuffMatt Brunt · Dutch PHP Conference 2018
• 16mA practical guide to implementing Content Security Policy (CSP) to secure Client-sideLavakumar Kuppan · React Nexus 2023
• 58mFixing XSS with Content Security PolicyKsenia Dmitrieva · AppSec California 2015
• 29mNo More XSS: Deploying CSP with nonces and strict-dynamicDevin Lundberg · BSidesSF 2018
• 01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…Scott Helme · NDC London 2018
• 24mTowards a post-XSS world.Mike West · JSConf EU 2013