Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Content Security Policies

DZone's Guide to

Content Security Policies

A Content Security Policy or CSP is an HTTP response header that defines what sources of content can be loaded on a web page. It is a way to combat XSS.

· Security Zone ·
Free Resource

Mobile is increasingly becoming a part of every consumers’ identity, but the increasing use of this digital channel is escalating the security risks faced by consumers and institutions.

A content Security Policy or CSP is an HTTP response header that defines what sources of content can be loaded on a web page. It is a way to combat Cross Site Scripting (XSS) attacks.

What Is an XSS Attack Then?

When you load a webpage it also loads various other resources like images, some CSS style sheets, various JavaScript files that you want to run, and probably many other things.

How do you know that you can trust all of these things? If you created them and they live under your control then the answer is probably yes. However, these days you will probably want to use resources from across the internet, like Youtube videos, Google analytics, disqus comments, jQuery libraries from a CDN, etc., and you can't be sure exactly what they are doing.

Imagine you had a page which you could add any text into a form which would then be displayed. A malicious user could add evil JavaScript or get the browser to load evil code from anywhere on the internet.

CSP to the Rescue!

A CSP allows the browser to only load from sources that you specify. You could specify that resources from your own site will load but the evil script will not.

Let's look at some examples

Content-Security-Policy: script-src 'self'

This allows <script> tags to only load from the current webhost. script-src is not the only keyword you can use, let's look at some of the others.

script-src - control what <script> tags will load.
style-src - control what CSS will load.
img-src - control what images will load.
frame-src - control what frames will load.
font-src - control what fonts will load.
object-src - control what object tags will load.
connect-src - control what resources a script can connect to.
media-src - controls what media (audio/video) will load.
default-src - if no specific rule exists then the default directive will run.

Content-Security-Policy: default-src https

This allows any content to be loaded from any site as long as it comes from a secure (https) site

Content-Security-Policy: default-src https://example.com

This allows any content to be loaded from https://example.com only.

How Do I Use This on My Site?

I have added CSPs into my web.config which works great for my .NET Framework code.

 <system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Content-Security-Policy" value="default-src https://example.com" />
     </customHeaders>
   </httpProtocol>
 </system.webServer>

For .NET Core, it is a bit more complex, as you don't tend to use web.config files, however, check out Anthony Chu's post, which has a solution to that problem.

Report Only

One last thing about CSPs to mention is the Report Only flag.

Content-Security-Policy-Report-Only

This does the same as the above but doesn't enforce anything, so you can fix any problems before you break anything.

To view your issues, just look in the developer tools in your favorite browser. Or you can configure all your reports to be collated in one place with a report-uri directive.

Content-Security-Policy: default-src https://example.com; report-uri https://example.report-uri.com/r/d/csp/reportOnly;

Scott Helme and Troy Hunt have a site called report-uri which offers a service for collating and viewing all your CSP violations so check it out if you want to know more about CSPs.

Explore the authentication advancements that are designed to secure accounts and payments—without overburdening consumers with a friction-laden experience.

Topics:
security ,content security policy ,web security ,xss

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}