In this talk, we distill our multi-year experience fighting XSS at Google with nonce-based Content Security Policy, one of the most misunderstood and arguably, most powerful web mitigation techniques.
We aim to provide a technical in-depth analysis of the effectiveness of different flavors of CSP for the many classes of XSS vulnerabilities, busting myths and common misunderstandings, and explore the often fuzzy boundaries between hardening and mitigation techniques. In a world where there are a dozen major root causes of XSS, each with its own, distinct, preventive measures, we define a threat model in which CSP can provide strong defense-in-depth guarantees and enforce best coding practices, leading to a real hardening effect.
We present advanced CSP kung-fu, and finally we share for the first time data on real-world sensitive applications where exploitation of XSS vulnerabilities has been prevented on modern browsers by CSP. After attending this talk you will understand CSP, knowing its strengths and limits while appreciating its complexity and multifaceted nature.