Monday, November 7, 2011

How I learned to stop worrying and embrace Content-Security-Policy

This week, the W3C Web Application Security working group held its first face-to-face meeting at TPAC, the W3C's annual technical meeting.  The main topic of discussion was moving Content-Security-Policy (CSP) from an unofficial draft onto the standards track.  I'm actually pretty excited about CSP now, but I wasn't always its biggest fan.

CSP has a bunch of features, but the core value proposition (in my view) is that web applications can whitelist where their scripts come from.  The main drawback of this approach is that authors need to remove all inline script from their web application because the browser doesn't know whether an inline script is part of the application or whether it was injected as part of a cross-site scripting (XSS) attack.

Initially, I was skeptical about CSP for two reasons:
  1. CSP has a bunch of functionality unrelated to mitigating XSS, which makes the feature more complicated than necessary.  Because I'm a big believer in minimal viable products, my initial reaction was to remove all the extra functionality and focus on the core use case for the first iteration.
  2. I was worried that removing all the inline scripts from a web application would be too hard because web applications use inline scripts frequently.  Joel Weinberger, Dawn Song, and I even wrote a paper exploring that issue.
I still view those criticisms as fair, but I worry less about those issues.  By and large, the early adopters I've worked with have been able to use CSP effectively, which is some evidence that the extra complexity isn't the end of the world.  I've also now built and retrofitted a number of non-trivial web applications to avoid inline script.  It's a fair amount of work, certainly, but not an insurmountable task.

Thanks to some great work by Thomas Sepez, Chrome now uses CSP in the vast majority its HTML-based user interfaces.  Over the years, there has been a steady trickle of XSS vulnerabilities in these interfaces, which is problematic because these interfaces (such as the browser's settings interface) have powerful privileges.  Now that Chrome uses CSP extensively, we can be confident that we've mitigated this entire class of vulnerabilities.

My perspective on CSP now is that it makes a serious dent in one of the biggest problems in web security.  It's definitely not a silver bullet (nothing ever is), but we should invest in CSP because we should be working on the big problems.  If we're not willing to dream big, we should just pack up our tent and go home.

111 comments:

  1. I just found your blog, and I already find it very interesting and useful. Keep blogging. I'll keep reading.

    ReplyDelete
  2. No doubt, this has actually been the best and foremost important thing to follow out, this has actually ended up my good day, I was searching quite relevant to that. See essay paper for best Papers.

    ReplyDelete
  3. It's in reality a great and useful piece of info. I'm glad that you shared this useful info with us. Please stay us informed like this. Thank you for sharing. Visit business phone calls for best Phone Calls.

    ReplyDelete
  4. Thanks for sharing this. I enjoy reading it. Keep it up! Send Flowers To Pune

    ReplyDelete
  5. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  6. Forte School of Music is providing Music Lessons howick Auckland , New Zealand. Forte School is best in Music , Singing , Guitar and Piano Classes. Contact us now 09 534 2223

    ReplyDelete
  7. Excellent blog share by you and i say keep blogging.
    Vashikaran Mantra

    ReplyDelete
  8. Excellent blog share by you and i say keep blogging.
    Vashikaran Love Spell

    ReplyDelete
  9. Excellent job done! I read your post and after that I desire to do something like you. Thanks for writing plus share this is the wonderful post.
    Love Marriage Specialist

    ReplyDelete
  10. Very interesting blog. Alot of blogs I see these days don't really provide anything that I'm interested in, but I'm most definately interested in this one. Just thought that I would post and let you know.
    geometry dash| sniper games |happy wheels | happy wheels 2 |agario| my little pony games mickey mouse games mahjong |pacman

    ReplyDelete
  11. Nice Post to share. Thanks...

    Fred Lam's ipro 2.0

    If you're aiming to find out about internet market
    ing, social networks, and so on, then Fred Lam's T
    he Better Business Mogul Blog is an exceptional lo
    cation to start. You'll learn a lot in an easy, ea
    sy to digest way that is a breath of fresh air in
    the blogging world.

    Reviews ipro Academy

    ReplyDelete
  12. If you're aiming to find out about internet market
    ing, social networks, and so on, then Fred Lam's T
    he Better Business Mogul Blog is an exceptional lo
    cation to start.
    Get ipro Academy 2.0


    ReplyDelete
  13. 100k factory ultra edition reviews
    ------------------------------------------------------------------------------------------------------------------
    There are many errors that can hurt your PPC project without you even understanding it. For this factor, I wish to present to you the leading 5 factors your Pay Per Click project suffers online. look at

    part 1 of this article..
    ------------------------------------------------------------------------------------------------------------------
    100k factory ultra edition

    ReplyDelete
  14. I just want to say : why you do not click to play
    minecraft games

    ReplyDelete
  15. You put really very helpful information. Keep it up. Keep blogging.

    - Happy Wheels
    - FNAF World
    - FNAF

    ReplyDelete
  16. This is extremely helpful info!! Very good work. Everything is very interesting to learn and easy to understood. Thank you for giving information.
    Trollface Quest 2| Dr Driving|Square Quick

    ReplyDelete
  17. Great info! I recently came across your blog and have been reading along.
    I thought I would leave my first comment. I don’t know what to say except that I have.
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  18. Good blog post. I want to thank you for interesting and helpful information and I like your point of view. Thank you!
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  19. ========================================================

    Hey,

    Are You Like To make MONEY Through ON-LINE?

    "Good website! I really love how it is easy on my eyes and the data are well written. I am wondering how I could be notified when a new post has been made. I have subscribed to your RSS feed which must do the trick! Have a nice day!"

    inbox blueprint download
    ---------------------------------------------------------
    inbox blueprint free
    Thanks & Regards
    ========================================================

    ReplyDelete
  20. Thanks for taking the time to discuss this, I feel about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with more information? It is extremely helpful for me.
    bubble shooter
    bubble trouble
    earn to die
    get on top
    gunblood
    gun mayhem
    bloxorz

    ReplyDelete
  21. The article you have shared here very awesome. I really like and appreciated your work. I read deeply your article, the points you have mentioned in this article are useful.
    raze 2
    raze 3
    return man 2
    strike force heroes
    strike force heroes 2
    run 2
    run 3
    sports heads football
    sports heads soccer championship

    ReplyDelete
  22. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  23. hanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    age of war 5
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    age of war 6
    age of war 4

    age of war 3

    earn to die game vip

    ReplyDelete
  24. Truyen ngon tinh hay la the loai truyen tinh cam
    Truyen teen hay la nhung truyen tinh yeu tuoi teen
    Don doc tai trang doc truyen online.

    ReplyDelete
  25. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die play
    earn to die
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  26. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work.

    Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    Sign in to Gmail to access to all Gooogle services. Log in to your account or sign up to create a new account
    gmail sign in

    gmail log in

    what's gmail?

    In this game, you start at the cavern men's age, then evolve! There is a total of 5 ages, each with its units and turrets. Take control of 16 different units and 15 different turrets to defend your base and destroy your enemy.
    age of war

    We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work.
    happy wheels

    strike force heroes

    earn to die

    Fireboy and Watergirl arrived again to the temple in the forest. 2 players together can help them to find their way out.
    fireboyandwatergirl

    ReplyDelete
  27. Thank you for sharing! It's great to know this information and I think it will be develop more :)
    gmail account login

    ReplyDelete
  28. Hi ,
    You have mentioned very interesting points! ps nice website.
    http://listacademyanik.com/dna-wealth-blueprint-3-0-review-bonus

    ReplyDelete
  29. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

    ReplyDelete
  30. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic.
    vertix.io | dog games | fighting games | mickey mouse games | Subway Surfers

    ReplyDelete
  31. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die
    earn to die 2
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels
    strike force heroes
    slitherio
    you keep up the fantastic work!my weblog
    age of war
    earn to die 5
    good game empire

    ReplyDelete
  32. Let’s keep out sites for your child! click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 | games for kids | racing games | pacman to play for free!

    ReplyDelete
  33. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels
    strike force heroes
    slitherio
    you keep up the fantastic work!my weblog
    earn to die 5
    good game empire
    tank trouble 2
    earn to die new

    ReplyDelete
  34. Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.
    dark souls 3 wiki emojis
    slither io supersnake io

    ReplyDelete
  35. Let’s keep are safe place to play the very best free games for kids! Please click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 | games for kids | racing games to play for free!

    ReplyDelete
  36. Let’s keep are safe place to play the very best free games for kids! Please click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 to play for free!

    ReplyDelete
  37. Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write
    Run 3 | Stick Run 2 | Return Man 2
    Run 2 | Stick Run | Return Man | run 3 game | run 3 unblocked

    ReplyDelete
  38. Welcomes to google terminal keep sharing such ideas in the future as well.
    google snake this was actually EARN TO DIE
    what i was looking for,and i am glad to came here! AGE OF WAR 2
    Hi! I’ve been reading your blog for a while HAPPY WHEELS
    I want you to thank for your time of this wonderful read!!! Slitherio
    Amazing insight you have on this, Slither io This article always blew me BIG FARM

    ReplyDelete
  39. Good blog post. I want to thank you for interesting and helpful information and I like your point of view. Thank you!
    slither io | wings io | science kombat | tank trouble 4

    ReplyDelete
  40. Thanks for sharing the information. It is very useful for my future. keep sharing. Can you play more games at :
    strike force kitty 2 | swords and souls 2 | strike force kitty | swords and souls

    ReplyDelete
  41. Great information I will tweet to my friends to get them to check it out. keep it up. Thanks for sharing!.If have a long time than visit to:
    red ball 4 | ninjago games | red ball 3 | ninjago games

    ReplyDelete
  42. I must be thankful for sharing your ideas.Thank you for the good writeup.its a brellint job.please visit here for more detail:
    Packers And Movers Bangalore
    Packers And Movers Bangalore

    ReplyDelete