Content Security Policy Keeps On Rolling

Content Security Policy is a method that browsers and websites use in conjunction to prevent various attacks, such as Cross Site Scripting, or XSS. Essentially when you visit a webpage it will send you back an HTTP Header letting your browser know that it wants to run the delivered code in a restricted way and that the code should only come from specific sources.

On a typical webpage all code is treated the same, despite its origin. Your browser has no way of knowing whether code from evil.com and code from benign.com is malicious, it runs it all if it’s on the page. If the content is served to the browser the browser runs it.

CSP implements a “least privilege” approach to websites. Least privilege is probably the single most powerful security concept and it’s lead to security features like SMEP/SMAP, DEP, MAC, DAC, and more.

A browser running code from a CSP enabled website will only run code on a whitelist basis. The code can be restricted to HTTPS://good.com/ and any code delivered from any other URL is denied.

Inline scripting is removed entirely as it’s too difficult to determine the origin. eval() is also denied by default, though it can be enabled.

Websites do have to opt into using a CSP, by default the  browser uses the same policy it always has, and the CSP has to be configured properly or it could be far less secure. Ideally we’d see websites like banking sites using CSP as it would be another way to ensure attackers could not gain entry into very sensitive data.