OWASP AppSec EU 2013: Content Security Policy - the panacea for XSS or placebo?
Channel: Christiaan008
Date: 08/12/2013

For more information and to download the video visit: http://bit.ly/appseceu13
Playlist OWASP AppSec EU 2013: http://bit.ly/plappseceu13

Speaker: Taras Ivashchenko

Content Security Policy (CSP) is the mechanism to mitigate one of the most 
popular web application issues called Cross-Site Scripting (XSS). 
CSP is a declarative policy that allows application to inform the browser 
about specific areas where application expects all resources to be loaded, 
such as scripts and images.

In this presentation, we will talk about:

1. XSS. Very briefly because in 2013 pretty much everyone knows about this attack.
2. CSP. What risks this mechanism covers and what does not:

- CSP inside 
- Browser support status and issues
- Policy definition mistakes and CSP common security considerations
- XSS without JS

3. Experience. How we implemented CSP on a service with an audience 
more than 11 million users per week:

- Changes in serivce
- Bugs in browser implementations
- Problems with 3rd party libraries
- Way from Report-Only to Block mode