Collaborate Disseminate
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don’t see an obvious way to do this via a CSP. Ideally I’d find something like
Restric… Continue reading Is there a way to limit cookies to certain hosts in HTTP?
A CSP response header is set on the web worker JS file, but it is not enforced by the browser. The CSP is enforced in the Web worker only if the parent document’s response header contains the CSP header. Is this expected?
index.html
I would like to block the execution of any instance of CSS’s url() function in CSS provided by my server. One promising method would be a CSP, but I’m not sure if this is possible using a CSP. Is it? And if not, what is the best way to acc… Continue reading Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?
Let’s say I have a simple web application which uses a single JavaScript (JS) file, loaded from its own domain, and has implemented the restrictive Content Security Policy (CSP) of default-src ‘self’. There’s a stored XSS in it whereby the… Continue reading CSP: any way to prevent inline scripts dynamically created by a trusted external script?
I would like to assess the actual risk for various CORS attacks when a web application properly sets CSP and other response headers, but the app server error page does not. When a 40x can be provoked by trying to access protected content, … Continue reading Security headers in application vs. Tomcat default 40x error
Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new domain that hides quite easily in a hacked site’s source code: “http[.]ps” (the actual malicious domain does not include the brackets, which are there to keep readers from being able to click on it). Continue reading Crafty Web Skimming Domain Spoofs “https”
I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS — why is it a solution?
My reason for asking this question stems from a question that i was recently asked… Continue reading Why CSP vs XSS?
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the absolute strongest security settings without l… Continue reading Best Firewall Zone Settings for Security Gli-net Routers
Is NONCE supported in Asp.Net when implementing the Content-Security-Policy header to protect from XSS ??
I read that NONCE was not supported in Asp.Net, however, I read another simple article, that shows how it is done? Does anyone use no… Continue reading NONCE not supported in Asp.Net for CSP implementation
We have below CSP derivatives defined in our site,
script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’ *.youtube.com; style-src ‘self’ ‘unsafe-inline’; frame-src *.facebook.com www.youtube.com;
As per this value, we only allowed faceboo… Continue reading Correct CSP frame-src value for iframes with empty src value