Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Content Security Policy 101 - Lightning Talk
Search
Christoph Rumpel
April 24, 2018
Technology
1
98
Content Security Policy 101 - Lightning Talk
This is a 5min talk version of Content Security Policy 101 talk.
Christoph Rumpel
April 24, 2018
Tweet
Share
More Decks by Christoph Rumpel
See All by Christoph Rumpel
How To Manage 5000+ Tests Efficiently
christophrumpel
0
28
Christoph Dreams Of Simple Code (Laravel Vienna Meetup)
christophrumpel
0
81
Why Refactoring Is The Best Tool To Write Better Code
christophrumpel
0
480
Debugging with PhpStorm & XDebug
christophrumpel
0
190
The final Laravel Service Container talk (Laracon Online)
christophrumpel
1
710
NomadPHP - The Laravel Core - Demystify The Beast
christophrumpel
0
120
Laravel Factories Reloaded (Laracon Online)
christophrumpel
1
250
The Beauty of Laravel's Notification System (Laracon EU Amsterdam)
christophrumpel
0
220
The Laravel Core - Demystify The Beast (New York)
christophrumpel
0
160
Other Decks in Technology
See All in Technology
SAVEPOINT α版
savepoint
0
550
AWS SAW を広めたい @四国クラウドお遍路
kazzpapa3
0
200
SORACOMで実現するIoTのマルチクラウド対応 - IoTでのクリーンアーキテクチャの実現 -
kenichirokimura
0
310
EitherT_with_Future
aoiroaoino
1
940
分野に潜むツールの紹介
pojiro
1
350
デジタル化・DX推進あるある
y150saya
0
230
RAGHack: Kickoff and RAG 101
pamelafox
0
280
なぜクラウドサービスで Web コンソールを提供するのか
shuta13
4
2k
手軽に始める? おうちサーバーのすゝめ
nyagasan
0
190
「家族アルバム みてね」における運用管理・ オブザーバビリティの全貌 / Overview of Operation Management and Observability in FamilyAlbum
isaoshimizu
4
100
React Aria で実現する次世代のアクセシビリティ
ryo_manba
4
990
Monitor GraalVM Native Apps with OpenTelemetry
logico_jp
0
110
Featured
See All Featured
BBQ
matthewcrist
83
9.1k
Intergalactic Javascript Robots from Outer Space
tanoku
268
26k
Imperfection Machines: The Place of Print at Facebook
scottboms
263
13k
Fontdeck: Realign not Redesign
paulrobertlloyd
80
5.1k
Designing for Performance
lara
604
68k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
28
2.2k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
663
120k
Designing Experiences People Love
moore
138
23k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
45
4.8k
Put a Button on it: Removing Barriers to Going Fast.
kastner
58
3.4k
Reflections from 52 weeks, 52 projects
jeffersonlam
346
20k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
38
9.1k
Transcript
Hello webclerks :)
Content Security Policy 101
Content Security Policy 101 Can Christoph do 40 slides in
5 minutes?
ABOUT ME
CHRISTOPH RUMPEL Web Developer PHP / Laravel Chatbots Talks @christophrumpel
christoph-rumpel.com
SECURITY IS HARD
SSL Input Handling Updates Packages Extension CSRF NONCES Weak Typing
Error Handling Storing Credentials Server Access SQL Prepared Statements Passwords Brute Force Attacks
Adobe Playstation Network Cloudflare FAMOUS LEAKS
How can we protect our sites when even big companies
can't?
Step by step
CONTENT SECURITY POLICY
CSP lets you define trusted resources.
Content-Security-Policy: policies
Content-Security-Policy: img-src *; script-src 'self'; Policies EXAMPLE
img-src *; script-src 'self'; DIRECTIVES
img-src *; script-src 'self'; LOCATIONS
img-src *; script-src 'self'; TRANSLATED Images are allowed to be
loaded from any resource
img-src *; script-src 'self'; TRANSLATED Scripts are allowed to be
loaded from the current site's origin only
img-src script-src DIRECTIVES
img-src script-src style-src font-src media-src form-action ...
* 'self' LOCATIONS
* 'self' domain.example.com *.example.com 'none' ...
CSP christoph-rumpel.com
BROWSER SUPPORT
BROWSER SUPPORT
INTEGRATIONS
SERVER CONFIGURATION Apache
SERVER CONFIGURATION Nginx
LARAVEL MIDDLEWARE
WP Content Security Policy Plugin - Screenshot Policies PLUGINS
MUCH MORE
HASHES AND NONCES
REPORTING
Content Security Policy 101 Laravel Response Caching And CSP CSP,
Hash-Algorithm, and Turbolinks Quick CSP Reference Guide MDN web docs CSP Level 2 W3C Recommendation CSP Level 3 Working Draft RESOURCES
THANKS
QUESTIONS?
THANKS AGAIN