You use Content Security Policy, don't you?

Kacper SokoLowski 

@KAAPA_S

Security

Security is HARD

$171 MILLION

...Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time...

XSS

Cross Site Scripting

=

Attacker is able to execute any JS code in

the context of our page.

1. Steal cookies

2. Steal localStorage data

3. Break the layout and style of the page

4. Whatever you can do with JavaScript...

https://www.owasp.org/

DEMO

HOW TO be SAFE?!

Sanitizer?

CSP

Content security Policy

=

google.com

facebook.com

scam.com

cdnjs.com

getbootstrap.com

google.com

facebook.com

scam.com

cdnjs.com

getbootstrap.com

google.com

facebook.com

scam.com

cdnjs.com

getbootstrap.com

<script src="..."></script>

<script src="..."></script>

<script>

alert('hello JSConfBP!');

...

</script>

<script>

alert('hello JSConfBP!');

...

</script>

HTTP HEADERS

Content-Security-Policy: script-src 'self' http://google.com ...

Content-Security-Policy: script-src 'self' http://google.com ...

Header

Content-Security-Policy: script-src 'self' http://google.com ...

Directive

Content-Security-Policy: script-src 'self' http://google.com ...

URL List

DEMO

1. connect-src

2. img-src

3. script-src

4. style-src

5. ....

CSP IS GREAT!

Many Parts OF your website

will probably Break

when you CSP FOR the first time

/index.html

/style.css

/script.js

CDN

/index.html

/style.css

/script.js

CDN

sUpported by FEW hosting providers

and CDNs

Icons by: Laura Reen, Webalys, Everaldo Coelho. THX

LINKS

1. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

2. https://en.wikipedia.org/wiki/2011_PlayStation_Network_outage

3. https://developers.google.com/web/fundamentals/security/csp/

4. https://en.wikipedia.org/wiki/Samy_(computer_worm)

5. https://www.npmjs.com/package/content-security-policy

Thanks!

@kaapa_s

Kacper Sokolowski