Content-Security-Policy: continuing the fight against XSS

When I wrote about CSRF, I said that it's important to configure CSP (Content-Security-Policy). So what is it?

Content-Security-Policy is an added layer of security that helps detect and mitigate certain types of attacks, including Cross Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.

To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header.

Alternatively, a meta element can be used to configure the policy, for example:

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https: // *; child-src 'none'" />

Examples: common use cases

Example 1:

A website administrator wants all content to come from the site's own origin (this excludes subdomains).

Content-Security-Policy: default-src 'self'

Example 2:

A website administrator wants to allow users of a web application to include images from any origin in their own content, but to restrict audio or video media to trusted providers, and all scripts only to a specific server that hosts trusted code.

Content-Security-Policy: default-src 'self'; img-src *; media-src media1.com media2.com; script-src userscripts.example.com

Here, by default, content is only permitted from the document's origin, with the following exceptions:

• Images may load from anywhere (note the "*").
• Media is only allowed from media1.com and media2.com (and not from subdomains of those sites).
• Executable script is only allowed from usercripts.example.com.

Enabling reporting

By default, violation reports aren't sent. To enable violation reporting, you need to specify the report-uri policy directive, providing at least one URI to which to deliver the reports:

Content-Security-Policy: default-src 'self'; report-uri reportcollector.example.com/collector;

Then you need to set up your server to receive the reports; it can store or process them in whatever manner you find appropriate.

Violation report syntax

The report JSON contains the following data:

• blocked-uri The URI of the resource that was blocked from loading by the Content Security Policy. If the blocked URI is from a different origin than the document-uri, the blocked URI is truncated to contain just the scheme, host, and port.
• disposition Either "enforce" or "reporting", depending on whether the Content-Security-Policy-Report-Only header or the Content-Security-Policy header is used.
• document-uri The URI of the document in which the violation occurred.
• effective-directive The directive whose enforcement caused the violation.
• original-policy The original policy as specified by the Content-Security-Policy HTTP header.
• referrer The referrer of the document in which the violation occurred.
• script-sample The first 40 characters of the inline script, event handler, or style that caused the violation.
• status-code The HTTP status code of the resource on which the global object was instantiated.
• violated-directive The name of the policy section that was violated.