Main Menu

Daily using/supporting

Get Firefox browser!
Get Thunderbird!
Get Opera browser!
Get The Gimp!
Get Inkscape!
Get LibreOffice!
Get Videolan!
Get Linux!
Get Mandriva!
Get Joomla!
Hacker Emblem

Popular Tags

Archives

Which topics would you like us to cover more?

Latest comments

Latest tweets

about 1 day ago Using REDIPS.drag to add drag and drop to your .Net webapplication #li #dib0 http://t.co/n8zY3s7d
about 7 days ago http://t.co/cknQcDbo #Kindle
about 15 days ago Freedom isn't the ability to choose what to do or say, but the ability to choose what not to do or say #freedom
about 29 days ago http://t.co/61KTQknI #Kindle
12 Apr 2012 Force the use of a networking adapter using C# #li #dib0 http://t.co/ZTJOPzOz
9 Apr 2012 http://t.co/k9yliR2t #Kindle
9 Apr 2012 Mandriva 2010.2 and USB devices in Virtualbox http://t.co/fwq9gbHB
9 Apr 2012 Execute a http request to you own site with PHP http://t.co/DIvWPrpd
Twitter
Prev Next
Home Architecture, security and coding Content Security Policy - A new countermeassure against XSS and CSRF
Content Security Policy - A new countermeassure against XSS and CSRF
Written by Division by Zero   
Tuesday, 02 November 2010 09:28

The Mozilla Foundation introduced a new tool in the battle against attacks like XSS and CSRF: CSP (Content Security Policy). As the wiki-page says it's not the first-line of defence, but rather a new layer for defense in depth.

By adding a new Http-header, X-Content-Security-Policy, the browser will allow or deny access to different sources of content. For example the following line:

X-Content-Security-Policy: allow 'self'; img-src *; script-src trustedscripts.example.com

Will allow all resources from the original source, images from everywhere and scripts only from trustedscripts.example.com. This way it will be harder for a potential attacker to show or use content from other sources.

Of course the browser needs to be able to react to this Http header. Only Firefox will do that for now, hopefully others will follow!

X-Content-Security-Policy: allow 'self'; img-src *; \
                           object-src media1.com media2.com *.cdn.com; \
                           script-src trustedscripts.example.com
Tags:

Related Articles
 

Add comment


Security code
Refresh

Prayer does not change God, but it changes him who prays. - Soren Kierkegaard


© 2009 - 2012, Division by Zero

Template based on the empire template by joomlashack 

Valid XHTML 1.0 Strict  Valid CSS!  Creative Commons License
This work by Division by Zero is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Netherlands License.