Content Security Policy Evolution: From Whitelists to Strict-Dynamic - AppSec EU 2017

Content Security Policy Evolution: From Whitelists to Strict-Dynamic - AppSec EU 2017

Explore the flaws in Content Security Policy's whitelist-based approach and discover an alternative using 'strict-dynamic' with nonces or hashes in this 35-minute conference talk from AppSec EU 2017. Learn about the implementation of effective policies in major Google products like Gmail and Photos. Gain insights into best practices, common pitfalls, and strategies for addressing recent bypasses of nonce-based policies. Delve into topics such as CSP support in core frameworks, auto-noncing with Closure Templates, and tools like CSP Mitigator and Evaluator. Understand the challenges of nonce exfiltration, reuse techniques, and dangling markup attacks while exploring detailed CSP violation reports and measuring coverage.