Protecting a Service Using CSP

on YouTube ↗32m

" summary

The talk covers using Content Security Policy (CSP) to protect web services: why CSP was implemented across several services, which classes of attacks (e.g., cross-site scripting and related injection threats) are now mitigated, and what practical difficulties were encountered during deployment.

AI-written summary · about

" chapters (19)

1. 0:00CSP intro
2. 1:09Attack risks
3. 2:31What is CSP
4. 6:47CSP evolution
5. 7:50Content-Security-Policy header
6. 9:15CSP directives and values
7. 11:43CSP compatibility issues
8. 13:10Inline styles and scripts
9. 15:58Nonce and hash usage
10. 16:42connect-src explained
11. 17:48CSP in Yandex Maps
12. 19:56report-uri and errors
13. 21:21Testing CSP
14. 22:46CSP tools
15. 23:09CSP checklist
16. 24:53CSP backward support
17. 25:41Q&A: CSP in requests
18. 26:45Q&A: CSP and extensions
19. 30:38CSP conclusion

" related talks

• 39mProtect Your Application with the Content Security Policy HTTP Security HeaderL. BRUNET · Forum PHP 2022
• 25mHow HTTP Content-Security-Policy can save your romantic eveningDominique Righetto · Voxxed Days Luxembourg 2024
• 42mDeploying and managing CSP: the browser-side firewallLavakumar Kuppan · Rootconf 2019
• 16mA practical guide to implementing Content Security Policy (CSP) to secure Client-sideLavakumar Kuppan · React Nexus 2023
• 24mTowards a post-XSS world.Mike West · JSConf EU 2013
• 32mWhat is CSP and Why Haven't You Applied it YetJoel Weinberger · AppSec California 2014
• 31mCCSP: Controlled Relaxation of Content Security Policies...Stefano Calzavara, Alvise Rabitti, Michele Bugliesi · 26th USENIX Security Symposium (USENIX Security '17)
• 40mContent Security Policy to the RescueDheeraj Joshi · PHP UK Conference 2018