rasa, 2105 AM Content Securty Poy - OWASP Cheat Sheet Series
Content Security Policy Cheat Sheet
Introduction
This article brings forth a way to integrate the defense in depth concept to the client-side of web
applications. By injecting the Content-Security-Policy (CSP) headers from the server, the browser is
aware and capable of protecting the user from dynamic calls that will load content into the page
currently being visited.
Context
The increase in XSS (Cross-Site Scripting), clickjacking, and cross-site leak vulnerabilities demands
a more defense in depth security approach
Defense against XSS
CSP defends against XSS attacks in the following ways:
1. Restricting Inline Scripts
By preventing the page from executing inline scripts, attacks like injecting
-
will not work:
2. Restricting Remote Scripts
By preventing the page from loading scripts from arbitrary servers, attacks like injecting
will not work,
By preventing the page from executing text-to JavaScript functions like evel , the Website will be
safe from vulnerabilities like the this:
-ntps:ifcheatshectseries.owasp.orgicheatsheets!Content_Securty_Polcy_Cheat_Sheetniml at rasa, 2105 AM Content Securty Poy - OWASP Cheat Sheet Series
/1 & Simple Calculator
var op! = getUriParaneter("op1") ;
var op2 = getUrParaneter("op2")
var sum = eval(*${opt) + ${0p2}"
console.log( "The sum is: ${sun}
4. Restricting Form submissions
By restricting where HTML forms on your website can submit their data, injecting phishing forms
wort work either.
5. Restricting Objects
And by restricting the HTML object tag it also won't be possible for an attacker to inject malicious
flash/Java/cther legacy executables on the page.
Defense against framing attacks
‘Attacks lke clickjacking and some variants of browser side-channel attacks (xs-leaks) require a
malicious website to load the target website in a frame.
Historically the x-Frane-options header has been used for this, but it has been obsoleted by the
frome-encestors CSP directive.
Defense in Depth
A strong CSP provides an effective second layer of protection against various types of
vulnerabilities, especially XSS. Although CSP doesrit prevent web applications from containing
vulnerabilities, it can make those vulnerabilities significantly more difficult for an attacker to
exploit.
Even on a fully static website, which does net aocept any user input, a CSP can be used to enforce
the use of Subresource Integrity (SRI). This can help prevent malicious code from being Icaded on.
-ntps:ifcheatshectseries.owasp.orgicheatsheets!Content_Securty_Polcy_Cheat_Sheetniml am rasa, 2105 AM Content Securty Poy - OWASP Cheat Sheet Series
the website if one of the third-party sites hosting JavaScript files (such as analytics scripts) is
compromised.
CSP is not a substitute for secure development
CSP should not be relied upon as the only defensive mechanism against XSS. Yournust still follaw
‘good development practices such as the ones described in Cross-Site Scripting Prevention Cheat
‘Sheet, and then deploy CSP on top of that as @ bonus security layer.
Policy Delivery
‘You can deliver @ Content Security Policy to your website in three ways.
1. Content-Security-Policy Header
Send a Content-Security-Policy HTTP response header from your web server.
Content-Security-Policy
Using a header is the preferted way and supports the full CSP feature set. Sendit in all HTTP
responses, nct just the index page.
2. Content-Security-Policy-Report-Only Header
Using the Content-Securiity-Pol icy-Report-Only ,youcan deliver a CSP that doesrit get
enforced.
Content -Security-Policy-Report-Only
Siill, violation reports ate printed to the console and defvered to aviolation endpoint ifthe resort-
to and report-uri directives are used.
Browsers fUly support the ability ofa site to use both content-Security-Policy and content=
Security-Policy-Report-Only together, without any issues. This pattem can be used for exemple
tonna strict Report-only policy (toget many violation reports), while having a looser enforced
policy (to avoid breaking legitimate site functionality).
3, Content-SecurityPolicy Meta Tag
-ntps:ifcheatshectseries.owasp.orgicheatsheets!Content_Securty_Polcy_Cheat_Sheetniml sit rasa, 2105 AM Content Securty Poy - OWASP Cheat Sheet Series
‘Sometimes you cannot use the Content Seaurity-Policy header if youare, e.4., Depleying your
HTML files in 2 CDN where the headers are out of your control.
Inthis case, you can still use CSP by specifying http-equiv metatagin the HTML markup, ike
so:
Almost everything is still supported. including full XSS defenses. However, you will nct be able 10
Use framing protections, sandboxing, of a CSP violation logging endpoint.
HTTP Headers
The following are headers for CSP.
* Content-Security-Policy : W3C Spec standard header. Supported by Firefox 23+, Chrome
25+ and Opera 19+
“WSC Spec standard header. Supported by Firefox
23+, Chrome25+ and Opera 19+, whereby the policy is non-blocking (‘fail oper) and a report is
ssentto the URL designated by the report-uri (ornewer -eport-to) directive. This is often
Used as a precursor to utilizing CSP in blocking mode (‘fail closed’)
‘00 NOT use X-Content Security Policy or X WebKit-CSP. Their implementations are obsolete
(Since Firefox 23, Chrome 25), limited, inconsistent, andincredbly bugcy.
© Content-Security-Policy-Report~
CSP Directives
Multiple types of directives exist that allow the developer to control the flow of the policies
granularly.
Fetch Directives
Fetch directives tell the browser the locations to trust and load resources from.
Most fetch directives have a certain fallback list specified in w3. This list allows for granular
contral of the source of scripts, images, files, etc.
‘+ chilé-sre allows the developer to control nested browsing contexts and worker execution
contexts.
-ntps:ifcheatshectseries.owasp.orgicheatsheets!Content_Securty_Polcy_Cheat_Sheetniml an rasa, 2105 AM Content Securty Poy - OWASP Cheat Sheet Series
* connect-sre provides control over fetch requests, XHR, eventsource, beacon and websockets
connections.
‘specifies which URLs to load fonts from.
‘+ img-sre specifies the URLs that images can be loaded from.
‘* manifest-sre specifies the URLs that application manifests mzy be loaded from,
© font
‘* medie-sre specifies the URLs ftom which video, audio and text track resources can be loaded
from.
* prefeteh-sre specifies the URLs from which resources can be prefetched from
* object-sre specifies the URLs from which plugins can be loaded from.
‘* seript-sre specifies the locations from which a script can be executed from. It isa fallback
directive for other script-like directives.
‘¢ script-sro-elem Conttols the location from which execution of script requests and
blocks can occur,
* script-sre-attr conttols the execution of event handlers.
+ style-sre controls from where styles get applied 10 a document. This inchides
elements, einport rues, and requests originating froma Link HTTP response header fel
+ style-sre-elen controls styles except for iniine attributes.
« style-sre-attr controls styles attributes.
‘+ default-sre is a fallback directive for the cther fetch directives. Directives that are specified
have no inheritance, yet directives that are nct specified wil fall back to the value of defauit-
Document Directives
Document directives instruct the browser about the properties of the document to which the
Policies will apply to.
‘+ base-uri specifies the possible URLs thet the element can use.
‘+ plugin-types limts the types of resources that can be loaded into the document (¢.g.
application/pdf). Srules apply to the affected elements, and 
