TLDR: don't use 'unsafe-inline'. Good article though.
The clue is in the name, I'd have thought.
Neatly Bypassing Content Security Policy
11–20 of 38 posts
Re: Neatly Bypassing Content Security Policy
#12Great article. Why is CSP so under-utilized? Less than 0.2% of the top 1m sites[0]. Although only 9% use basic features like secure cookies, and 6% HSTS. [0] https://blog.mozilla.org/security/2018/02/28/analysis-alexa-...
Because most ad networks and analytics providers don't tell you what CSP header to add to work reliably. Partly because ad networks can rotate in ads/resellers/scripts from hundreds of companies. Also, the resulting header can be quite long delaying the first byte of content (for each resource on the page).
Re: Neatly Bypassing Content Security Policy
#13Great article. Why is CSP so under-utilized? Less than 0.2% of the top 1m sites[0]. Although only 9% use basic features like secure cookies, and 6% HSTS. [0] https://blog.mozilla.org/security/2018/02/28/analysis-alexa-...
Way too complex. Followed the development up until 2.0, and I was already lost. Take this as someone who was breathing on the spec almost every day for a year. Now reading the latest spec is like trying to understand kernel.
Re: Neatly Bypassing Content Security Policy
#14TLDR: CSP can by bypassed if you don't use it on all responses, like error pages.
This is of course not bypassing CSP.
Re: Neatly Bypassing Content Security Policy
#15Oh, not CSP as in concurrency. Makes more sense now.
Re: Neatly Bypassing Content Security Policy
#16Oh, not CSP as in concurrency. Makes more sense now.
* Stands in this line
Re: Neatly Bypassing Content Security Policy
#17Earlier quoted context omitted.
The deployment difficulty is also high, especially for what it offers. Deploying CSP on anything non-trivial involves a lot of coordination with basically anyone who runs code on your site.
This is the big one. Lots of sites have marketing departments which like to switch out their advertising, engagement, A/B testing, etc. code on a regular basis. Which in turn requires either changing the CSP frequently to accommodate, or else opening holes in the CSP to allow marketing to just copy/paste inline JS and other badness. At which point it's hard to justify CSP.
This has been my feature work for the past couple months (I work on an enterprise site builder, basically, with some users doing what you describe -- we need to support that but hopefully with a smaller/harder to misfire footgun). There's a lot of feature complexity even after you've simplified it down, and it's kind of maddening how much effort it is to just send an extra (correct for the context) string in the response headers.
The spec versions are interesting to read too, as well as browser compatibility. Differences in interpretation of the spec lead to github issues which lead to browsers fixing things in the past few months that have been part of the spec for much longer. (And if you have a big chunk of IE11 users, "what's the point" is valid.) An example of a spec issue is that I'm working on adding an endpoint for the report-uri directive so we can log some metrics but the first thing you see when reading about report-uri is that it's been deprecated in favor of report-to, but literally no stable browser release supports report-to yet.
It's also not really enough. https://github.com/tc39/proposal-frozen-realms is a useful extension, since it would allow frameworks to do what they need to set up everything but then lock down objects from further extension/abuse...
Re: Neatly Bypassing Content Security Policy
#18Oh, not CSP as in concurrency. Makes more sense now.
I assumed Constraint Satisfaction Problem
Re: Neatly Bypassing Content Security Policy
#19It's almost like there's a clue in the name 'unsafe-inline'
Re: Neatly Bypassing Content Security Policy
#20Great article. Why is CSP so under-utilized? Less than 0.2% of the top 1m sites[0]. Although only 9% use basic features like secure cookies, and 6% HSTS. [0] https://blog.mozilla.org/security/2018/02/28/analysis-alexa-...
It may also prevent tooling to work on your site. E.G: bookmarklet won't work anymore. On browsers without extensions, they are the only way to get extra features. It's especially annoying on github.
Actually CSP can also block content modifications by extensions. I frequently get CSP reports from browsers using plugins that want to insert something on my site. Some time ago I also got CSP reports that indicated the AdBlocker couldn't touch the site too...