Monday, November 7, 2011

How I learned to stop worrying and embrace Content-Security-Policy

This week, the W3C Web Application Security working group held its first face-to-face meeting at TPAC, the W3C's annual technical meeting.  The main topic of discussion was moving Content-Security-Policy (CSP) from an unofficial draft onto the standards track.  I'm actually pretty excited about CSP now, but I wasn't always its biggest fan.

CSP has a bunch of features, but the core value proposition (in my view) is that web applications can whitelist where their scripts come from.  The main drawback of this approach is that authors need to remove all inline script from their web application because the browser doesn't know whether an inline script is part of the application or whether it was injected as part of a cross-site scripting (XSS) attack.

Initially, I was skeptical about CSP for two reasons:
  1. CSP has a bunch of functionality unrelated to mitigating XSS, which makes the feature more complicated than necessary.  Because I'm a big believer in minimal viable products, my initial reaction was to remove all the extra functionality and focus on the core use case for the first iteration.
  2. I was worried that removing all the inline scripts from a web application would be too hard because web applications use inline scripts frequently.  Joel Weinberger, Dawn Song, and I even wrote a paper exploring that issue.
I still view those criticisms as fair, but I worry less about those issues.  By and large, the early adopters I've worked with have been able to use CSP effectively, which is some evidence that the extra complexity isn't the end of the world.  I've also now built and retrofitted a number of non-trivial web applications to avoid inline script.  It's a fair amount of work, certainly, but not an insurmountable task.

Thanks to some great work by Thomas Sepez, Chrome now uses CSP in the vast majority its HTML-based user interfaces.  Over the years, there has been a steady trickle of XSS vulnerabilities in these interfaces, which is problematic because these interfaces (such as the browser's settings interface) have powerful privileges.  Now that Chrome uses CSP extensively, we can be confident that we've mitigated this entire class of vulnerabilities.

My perspective on CSP now is that it makes a serious dent in one of the biggest problems in web security.  It's definitely not a silver bullet (nothing ever is), but we should invest in CSP because we should be working on the big problems.  If we're not willing to dream big, we should just pack up our tent and go home.

346 comments:

  1. I just found your blog, and I already find it very interesting and useful. Keep blogging. I'll keep reading.

    ReplyDelete
  2. No doubt, this has actually been the best and foremost important thing to follow out, this has actually ended up my good day, I was searching quite relevant to that. See essay paper for best Papers.

    ReplyDelete
  3. It's in reality a great and useful piece of info. I'm glad that you shared this useful info with us. Please stay us informed like this. Thank you for sharing. Visit business phone calls for best Phone Calls.

    ReplyDelete
    Replies
    1. A World Famous Muslim Astrologer. Our Molvi Hazrat Muhammad Ali Ji - Rohani Dua
      Wazifa, Dua for Love

      Delete
  4. Thanks for sharing this. I enjoy reading it. Keep it up! Send Flowers To Pune

    ReplyDelete
  5. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  6. Forte School of Music is providing Music Lessons howick Auckland , New Zealand. Forte School is best in Music , Singing , Guitar and Piano Classes. Contact us now 09 534 2223

    ReplyDelete
  7. Such a excellent job you done to share your views about this topic.
    Black Magic Removal
    Black Magic Spell
    Indian Astrologer

    ReplyDelete
  8. Excellent blog share by you and i say keep blogging.
    Vashikaran Mantra

    ReplyDelete
  9. Excellent blog share by you and i say keep blogging.
    Vashikaran Love Spell

    ReplyDelete
  10. Excellent job done! I read your post and after that I desire to do something like you. Thanks for writing plus share this is the wonderful post.
    Love Marriage Specialist

    ReplyDelete
  11. Nice Post to share. Thanks...

    Fred Lam's ipro 2.0

    If you're aiming to find out about internet market
    ing, social networks, and so on, then Fred Lam's T
    he Better Business Mogul Blog is an exceptional lo
    cation to start. You'll learn a lot in an easy, ea
    sy to digest way that is a breath of fresh air in
    the blogging world.

    Reviews ipro Academy

    ReplyDelete
  12. If you're aiming to find out about internet market
    ing, social networks, and so on, then Fred Lam's T
    he Better Business Mogul Blog is an exceptional lo
    cation to start.
    Get ipro Academy 2.0


    ReplyDelete
  13. 100k factory ultra edition reviews
    ------------------------------------------------------------------------------------------------------------------
    There are many errors that can hurt your PPC project without you even understanding it. For this factor, I wish to present to you the leading 5 factors your Pay Per Click project suffers online. look at

    part 1 of this article..
    ------------------------------------------------------------------------------------------------------------------
    100k factory ultra edition

    ReplyDelete
  14. You put really very helpful information. Keep it up. Keep blogging.

    - Happy Wheels
    - FNAF World
    - FNAF

    ReplyDelete
  15. Great info! I recently came across your blog and have been reading along.
    I thought I would leave my first comment. I don’t know what to say except that I have.
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  16. Good blog post. I want to thank you for interesting and helpful information and I like your point of view. Thank you!
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  17. Thanks for taking the time to discuss this, I feel about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with more information? It is extremely helpful for me.
    bubble shooter
    bubble trouble
    earn to die
    get on top
    gunblood
    gun mayhem
    bloxorz

    ReplyDelete
  18. The article you have shared here very awesome. I really like and appreciated your work. I read deeply your article, the points you have mentioned in this article are useful.
    raze 2
    raze 3
    return man 2
    strike force heroes
    strike force heroes 2
    run 2
    run 3
    sports heads football
    sports heads soccer championship

    ReplyDelete
  19. Truyen ngon tinh hay la the loai truyen tinh cam
    Truyen teen hay la nhung truyen tinh yeu tuoi teen
    Don doc tai trang doc truyen online.

    ReplyDelete
  20. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die play
    earn to die
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  21. Thank you for sharing! It's great to know this information and I think it will be develop more :)
    gmail account login

    ReplyDelete
  22. Hi ,
    You have mentioned very interesting points! ps nice website.
    http://listacademyanik.com/dna-wealth-blueprint-3-0-review-bonus

    ReplyDelete
  23. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

    ReplyDelete
  24. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic.
    vertix.io | dog games | fighting games | mickey mouse games | Subway Surfers

    ReplyDelete
  25. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die
    earn to die 2
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels
    strike force heroes
    slitherio
    you keep up the fantastic work!my weblog
    age of war
    earn to die 5
    good game empire

    ReplyDelete
  26. Let’s keep out sites for your child! click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 | games for kids | racing games | pacman to play for free!

    ReplyDelete
  27. The best space for your child to relax!: wingsio
    slither io

    ReplyDelete
  28. Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write
    Run 3 | Stick Run 2 | Return Man 2
    Run 2 | Stick Run | Return Man | run 3 game | run 3 unblocked

    ReplyDelete
  29. Great information I will tweet to my friends to get them to check it out. keep it up. Thanks for sharing!.If have a long time than visit to:
    red ball 4 | ninjago games | red ball 3 | ninjago games

    ReplyDelete
  30. I want to share any applications example baixar snapchat, google play and play store. Snapchat is app which everybody like, it's chat app. Baixar google play and play store are two applications of google. It allows you download applications and games which you like. Please, baixar play store to mobile to experience

    ReplyDelete
  31. I found a lot of information here to create this actually best for all newbie here. Thank you for this information.
    wingsio | minecraft | wings.io | minecraft2 | wings io

    ReplyDelete
  32. Great content and really interesting.We are really lucky to find such blog with amazing content.
    a small orange promo codes

    ReplyDelete

  33. I do not know if it’s just me or if everyone else experiencing
    issues with your site. It appears as though some of the text within your posts
    are running off the screen. Can somebody else please provide feedbackThis might be a problem with my internet browser because I’ve had
    this happen before.
    Happy Veterans Day 2016 Images
    Happy Veterans Day 2016 Pictures
    Happy Veterans Day 2016 Pics
    Happy Veterans Day 2016 Quotes
    Happy Veterans Day 2016 Wishes
    Happy Veterans Day 2016 Photos
    Happy Veterans Day 2016 Wallpapers
    Happy Veterans Day 2016 Parade

    ReplyDelete
  34. this is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    age of war | red ball | earn to die 5 | Tank trouble | happy wheels | earn to die 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    tank trouble unblocked | wings io | strike force heroes | age of war | hotmail login

    ReplyDelete
  35. Run 3 unblocked is the third install of the Run Serie. Skate, float, bounce, and/or jump your way through even more space tunnels! Run 2 unblocked game is next games in run series, now you can play run game with more and more level. Try to run as far as possible, good luck. Tanks Trouble is a game designed by danish Mads Purup. It is a maze party game with 1-3 players on one computer. The objective of the game is to destroy the other tanks to get a point.
    Run 2 - Run 2 unblocked - Tank Trouble - Tank Trouble 2

    ReplyDelete
  36. To join the free games you go here. It will have a lot of great games for you that
    gun mayhem 3 | can your pet 2
    learn to fly 3 | happywheels
    tank trouble 3

    ReplyDelete
  37. This winter I'll tell him, with great things. If we were young, and we belong to each other, why not take advantage of these days?
    geometry dash 2.0 , geometry dash , geometry dash 2.0 apk , geometry dash apk , geometry dash online

    ReplyDelete
  38. When the influx of capital and go outside, will more than to have someone to think about. And not the dark house lies waiting, by a person under the porch waiting before. I'm not sure who it was you
    run 2 , run 2 game , run , play run 2 , run 3

    ReplyDelete
  39. Nice Article, I enjoyed reading it. Keep Writing
    Ankita From Non Return Valve

    ReplyDelete
  40. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.

    Discover our website bounty of free online games now!
    Our website has the biggest collection of free online games. Totally new games are added every day!

    age of war 2| gold Miner 2| unfair Mario 2 | cubefield 2 |tanki Online 2

    ReplyDelete
  41. Thanks for sharing such a valuable information.Im very thankful to you that you had given me this opportunity to write on this blog.please visit our website I assure you that it will be very useful for our website.
    Packers And Movers Gurgaon

    ReplyDelete
  42. I like your topic of selection for blog but want to suggest you for sharing some more information regarding your subject so that we can understand your thought more clearly
    Packers And Movers Bangalore

    ReplyDelete
  43. Excellent post! I must thank you for this informative read. I hope you will post again soon. Warehousing of merchandise....
    Packers And Movers Pune

    ReplyDelete
  44. The share your really gives us excitement. Thanks for your sharing. If you feel tired at work or study try to participate in our games to bring the most exciting feeling. Thank you!
    hotmail login | red ball

    ReplyDelete
  45. You need to have time to take care of the active. It in fact was a amusement account it. Look advanced to far added agreeable from you.

    baixar banana kong , banana kong , download banana kong , banana kong download , banana kong

    ReplyDelete
  46. Life becomes more interesting and wonderful when you share your memorable moments with friends and family through unique photographs. You can create your own unique style impressed with image editing software. And after hours of work stress you can also
    dr driving, dr driving baixar ,download dr driving, dr driving

    ReplyDelete
  47. Life becomes more interesting and wonderful when you share your memorable moments with friends and family through unique photographs. You can create your own unique style impressed with image editing software. And after hours of work stress you can also

    tank trouble, tank trouble 2, tank trouble games, tank trouble

    ReplyDelete
  48. You need to have time to take care of the active. It in fact was a amusement account it. Look advanced to far added agreeable from you.

    entrar hotmail agora , hotmail entrar, entrar hotmail , entrar no hotmail

    ReplyDelete
  49. Mostly people have all the same things when they are writing academic task or any other writing, especially light music most people like during the writing.
    dream league soccer download , dream league soccer apk , download dream league soccer , dream league soccer

    ReplyDelete
  50. Mostly people have all the same things when they are writing academic task or any other writing, especially light music most people like during the writing.

    subway surf , baixar subway surf, subway surf download , download subway surf

    ReplyDelete
    Replies
    1. This is really very informative post and great read for me. It’s my first visit to your website and I have found it so useful and informative specially this post. Keep up the good work! Thank you very much for this post. Your valuable Bangladeshi readers will be like SSC Result 2018 of Bangladesh Education Board. All education Board SSC Result 2018 BD available here. Thanks again.

      Delete
  51. here you can check out some happy birthday wishes friend family brother

    ReplyDelete

  52. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game |
    tanki online game

    ReplyDelete
  53. Visit us now to view & share beautiful collection of Best Images of
    rose day 2017

    ReplyDelete
  54. شركة نقل عفش واثاث بالدمام ابيات الشرقيه لخدمات نقل العفش والاثاث بالدمام
    شركة نقل عفش بالدمام
    نقل عفش بالخبر
    شركة نقل اثاث الدمام
    نقل عفش الدمام
    نقل عفش بالدمام
    ان اردت نقل عفش منزلك بالدمام ابيات الشرقية من اهم شركات نقل العفش بالدمام والخبر والجبيل والقطيف والاحساء

    ReplyDelete
  55. Visit us now to view & share beautiful collection of Best Images of
    chocolate day images

    ReplyDelete

  56. Wonderful blog! I found it while searching on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Many thanks.
    2048 online | tanki online 3

    ReplyDelete
  57. Looking for RO Water Purifier in MUmbai so visi now and order best RO water purifier in Mumbai.

    ReplyDelete
  58. Phone Repair in Dubai - Instant Fix Leading one stop solution for all brand mobile repair and service in Dubai. screen damage, unlock mobile all service available.

    ReplyDelete
  59. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.

    trailor of tubelight
    Tubelight Wiki
    Promote Tubelight at Radio Mirchi
    Tubelight Moview Ringtone

    ReplyDelete
  60. On the off chance that you have no other choice than getting a payday advance, discover a place that has the best loan fees and strategies. A few organizations will remove cash from your paycheck to reimburse your advance in the event that you can't pay it back in time. Attempt to maintain a strategic distance from this if conceivable. Cash Advance

    ReplyDelete
  61. Also, you would prefer not to part ways with your friends and family. Thus, in the event that you acquire from a credit supplier, nobody from your friends and family will come to think about it.
    Cash Advance Chicago

    ReplyDelete
  62. There is no surrender of a vehicle. It's an or more in addition to all around. An auto title credit is not as startling as it sounds if brought out with an authorized and mindful loan specialist.
    auto title loans online

    ReplyDelete

  63. Photoshop Online Alternative is a perfect alternative to photoshop photos edit. A free online photo editor includes all the basic features as well as the extra bells and whistles that most people need to photos edit and enhance their photos and images. photos editing, photos editor

    ReplyDelete
  64. Dealkare Packers and movers in gangtok is a team of experts who take care of customers belongings while packing and moving. We always use best quality material and if need to use bubble wrap or wooden box we always use that kind of packaging materials with that kind of things there is no chance of damaging goods. For details visit to www.dealkare.com.

    ReplyDelete
  65. Nowadays, android technology is becoming very popular and many students want to make career on it but they do not have enough knowledge about that technology. So you are eager to learn android technology ITSWS is the best Android Training Institute in Noida where you can learn that technology under the guidance of experts.

    ReplyDelete

  66. Find top 10 Packers and movers in east of kailash at Dealkare. Dealkare is a web portal where user can find out verified and professional packing and moving experts.

    ReplyDelete
  67. Awesome Post!
    Check out Happy Diwali Greetings 2017
    Also download latest movie LOGAN 2017 DUAL AUDIO 720P BLURAY HINDI
    Also Read trending Story Expectations vs reality
    Also Check out Latest vacancy of Government Job Kar Tet Recruitment 2017

    ReplyDelete
  68. Vashikaran Specialist

    Vashikaran Specialist Aghori BaBa ji Use vashikaran for satisfy your wants and utilizing this vashikaran for recover your affection by most capable vashikaran |
    वाशिकरण भारतीय गुप्त दुनिया में बहुत लोकप्रिय है इसका इस्तेमाल कई प्रयोजनों के लिए किया जाता है जैसे कि पत्नी को नियंत्रित करना, प्रियजनों, उच्च अधिकारियों, एहसान लाने, यहां तक कि दुश्मनों को अपने व्यवसाय को ध्यान में रखने के लिए मजबूर करना ।


    http://blackmagicvashikaranspecialist.com/vashikaran-specialist/

    M No - +91-9116579959

    ReplyDelete
  69. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    cara menggugurkan kandungan
    cara menggugurkan hamil

    ReplyDelete
  70. Above blog is informative blog on how to improve web securities. it is importation for user and consumer who are do his business on web.

    http://hairypussy9.com/


    hairy pussy

    ReplyDelete
  71. Do you have your driver's permit with you? There are many elements which identify with this capability.
    Check Cashing San-diego
    Payday Loans Chicago
    Car Title Loans Chicago

    ReplyDelete
  72. Online games help sharpen abilities. By enjoying completely different games, the kids are able to develop their abilities. This they do in a manner that is harmonious and fun, particularly on the subject of puzzle games. When the mind is put to work, totally different abilities develop better compared to how they'd when enjoying traditional games that don't require a lot concentration.

    They are enjoyable and easy. Net games are designed to be not solely fun, but additionally very easy to grasp. Each child or everyone else fascinated to play friv online will discover them very straightforward to master. This makes it even easier to develop the skills which are wanted to nail the games within a short period of time. They're simple, but additionally very challenging to offer educational advantages they are designed for.

    ReplyDelete
  73. Nice And Informative Website. Please Keep Continue Such Kind Of Effort. I Shared Your Post With My Friends Also. Ask Free Question Related To Vashikaran Solutions, Black Magic Solution, Black Magic Removal, Inter Caste Love Marriage, Love Problem Solution, etc. We Are The Vashikaran Specialist Baba Ji. We Will Be Happy To Answer You Free Of Cost. Visit Our Website www.Lovevashikaranexpert.In
    Vashikaran Specialist In Delhi
    Black Magic Specialist Baba Ji
    Love Marriage Specialist Baba Ji
    Love Vashikaran Specialist Molvi Ji
    Love Problem Solution Baba Ji
    Vashikaran Mantra

    ReplyDelete
  74. Nice And Informative Website. Please Keep Continue Such Kind Of Effort. I Shared Your Post With My Friends Also. Contact With love problem solution baba ji Ask Free Question Related To Black Magic Solution, Black Magic Removal, Inter Caste Love Marriage, Love Problem Solution, Vashikaran Solutions etc. We Are The Black Magic Specialist Baba Ji. We Will Be Happy To Answer You Free Of Cost. Visit Our Website www.Lovevashikaranexpert.In Contact- +91 9915707766

    ReplyDelete
  75. Ask Free Question Related To Black Magic Solution, Black Magic Removal, Inter Caste Love Marriage, Love Problem Solution, Vashikaran Solutions etc. We Are The Black Magic Specialist Baba Ji. We Will Be Happy To Answer You Free Of Cost. Visit Our Website www.Lovevashikaranexpert.In Contact- +91 9915707766

    ReplyDelete
  76. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check real kik girlsl and check my work

    ReplyDelete
  77. thanks for all the info i got what i was seek to know really nice community keep helping each other keep spreading knowledge

    ReplyDelete