![]() A level 3 spec has been published, but is largely unimplemented in the major browsers. The list below represents the state of the directives as of level 2. Let's quickly walk through the rest of the resource directives. You've already seen script-src, so the concept should be clear. While script resources are the most obvious security risks, CSP provides a rich set of policy directives that enable fairly granular control over the resources that a page is allowed to load. Policy applies to a wide variety of resources # When a clever attacker manages to inject code into your site, they'll run headlong into an error message rather than the success they were expecting. With this policy defined, the browser simply throws an error instead of loading script from any other source. The browser dutifully downloads and executes JavaScript from over HTTPS, as well as from the current page's origin. We've specified 'self' as one valid source of script, and as another. Simple, right? As you probably guessed, script-src is a directive that controls a set of script-related privileges for a specific page. Since we trust to deliver valid code, and we trust ourselves to do the same, let's define a policy that only allows script to execute when it comes from one of those two sources: Content-Security-Policy : script-src 'self' Even if an attacker can find a hole through which to inject script, the script won't match the allowlist, and therefore won't be executed. Instead of blindly trusting everything that a server delivers, CSP defines the Content-Security-Policy HTTP header, which allows you to create an allowlist of sources of trusted content, and instructs the browser to only execute or render resources from those sources. The browser happily downloads and executes any code a page requests, regardless of source. We trust that code, but we can't expect the browser to figure out on its own that code from is awesome, while code from probably isn't. For example, the Google +1 button at the bottom of this page loads and executes code from in the context of this page's origin. The issue exploited by XSS attacks is the browser's inability to distinguish between script that's part of your application and script that's been maliciously injected by a third-party.
0 Comments
Leave a Reply. |