Content Security Policy: A successful mess between hardening and mitigation
In this talk, we distill our multi-year experience fighting XSS at Google with nonce-based Content Security Policy, one of the most misunderstood and arguably, most powerful web mitigation techniques. We aim to provide a technical in-depth analysis of the effectiveness of different flavors of CSP for the many classes of XSS vulnerabilities, busting myths and common misunderstandings, and explore t
CSP Lv.2の話
#ssmjp 2014/10 XSSの運用の話 間違いなどありましたら @yagihashoo まで。 ## 10/28 9:26追記 nonce-value、規格上はBase64だよ！という指摘をいただいたのでスライド18-19を修正しました。 詳細は以下をご覧ください。 http://www.w3.org/TR/CSP2/#source-list-valid-nonces ## 10/29 15:00追記 Path matchingの例示について間違いがあったためスライド14を修正しました。Read less
A primer on Content Security Policy
Content Security Policy (CSP) is as a security concept aiming to prevent XSS and other forms of browser–based attacks right where they happen — in the browser. CSP has been around for a little while but it’s only now that browser vendors are closing in on implementing most of the W3C specification. This talk will take a look at what CSP is, why it matters and how to use it with Ruby–based web appl
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
BSidesLA Managing Content Security Policy
