Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Content Security Policy 101

Content Security Policy 101

As more and more services get digital these days, security has become a significant aspect of every application. Especially when it comes to third-party code, it is tough to guarantee safety. But in general, XSS and Code Injection is a big problem these days. Content Security Policy provides another layer of security that helps to detect and protect different attacks. In this talk, I will introduce this concept and its main features, as well as show real-world examples and integrations for WordPress.

Christoph Rumpel

April 07, 2018
Tweet

More Decks by Christoph Rumpel

Other Decks in Technology

Transcript

  1. SSL Input Handling Updates Packages Plugins CSRF NONCES Weak Typing

    Error Handling Storing Credentials Server Access SQL Prepared Statements Passwords Brute Force Attacks
  2. Content Security Policy (CSP) is an added layer of security

    that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. “ „ MDN WEB DOCS
  3. img-src *; script-src 'self'; TRANSLATED Scripts are allowed to be

    loaded from the current site's origin only
  4. Use CSP Don't allow inline scripts Start in report only

    mode Learn about dependencies SUMMARY
  5. Content Security Policy 101 Laravel Response Caching And CSP CSP,

    Hash-Algorithm, and Turbolinks Quick CSP Reference Guide MDN web docs CSP Level 2 W3C Recommendation CSP Level 3 Working Draft RESOURCES