Deploying and managing CSP: the browser-side firewall
summary
Covers client-side data exfiltration attacks and how Content Security Policy (CSP) can be used as a browser-side firewall to detect and prevent them. Describes CSP capabilities and limitations, offers guidance on designing and deploying CSP rules to stop or detect exfiltration, and explains techniques for monitoring policy violations and generating alerts.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:44Outline
- 9:39At JavaScript level
- 10:48Problems with the JavaScript Approach
- 14:38CSP Header Example
- 16:23Directive value
- 21:03CSP Violations
- 21:34CSP Violation Report
- 25:58Data Exfiltration via DNS Prefetch
- 32:03Tooling
- 32:54Conclusion
related talks
32mProtecting a Service Using CSP
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
39mProtect Your Application with the Content Security Policy HTTP Security Header
24mTowards a post-XSS world.
25mHow HTTP Content-Security-Policy can save your romantic evening
32mWhat is CSP and Why Haven't You Applied it Yet
46mContent Security Policies: Let's Break Stuff
51mPushing CSP to PROD