Tweet
Tweet

Slide 1

Slide 1 text

HTTP Security A matter of trust rj zaworski, versal inc. · @rjzaworski · github.com/rjz

Slide 2

Slide 2 text

Browsers ★ Do what servers tell them to ★ Respect standards (mostly) ★ Render as much of the server response as they can

Slide 3

Slide 3 text

Trust is a Big Deal ★ Servers can be compromised, impersonated, or simply misconfigured ★ How can we tell if content is trustworthy? The short answer is, “we can’t”.

Slide 4

Slide 4 text

HTTP can help $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block

Slide 5

Slide 5 text

Transport Security $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (https://tools.ietf.org/html/rfc6797)

Slide 6

Slide 6 text

Transport Security ★ Ensure the browser never visits the http version of a website ★ Force transport-layer security (TLS)

Slide 7

Slide 7 text

Transport Security Why bother? ★ eavesdropping ★ man in the middle (data tampering, host spoofing, etc)

Slide 8

Slide 8 text

Transport Security ★ Protects from common wireless attacks (spoofing, sniffing, e.g. SSLStrip + Firesheep) ★ Protects from mixed-content errors (CSS, SWF)

Slide 9

Slide 9 text

Content Security Policies $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (https://w3c.github.io/webappsec/specs/content-security-policy/)

Slide 10

Slide 10 text

Content Security Policies ★ Helps detect/prevent XSS, mixed-content, and other classes of attack ★ Whitelist what is or isn't allowed on a page ★ Describe access to specific types of content in terms of directives

Slide 11

Slide 11 text

Content Security Policies ★ Implemented via HTTP header ★ or a tag

Slide 12

Slide 12 text

Content Security Policies Some directives: ★ default-src - define base policy ★ script-src - define valid origins for tags ★ connect-src - XHRs, WebSocket and EventSource ★ form-action - form actions

Slide 13

Slide 13 text

Content Security Policies ★ Policies may be layered ★ Policies are restrictive A request must pass all announced policies to be served!

Slide 14

Slide 14 text

Content Security Policies Report-Only: log without enforcing Content-Security-Policy-Report-Only: \ default-src 'self'; \ report-uri https://test.versal.com/csp-reports Looks familiar...

Slide 15

Slide 15 text

Content Security Policies Risks: ★ CSS Parsing is still vulnerable ★ Browser support is incomplete

Slide 16

Slide 16 text

X-Content-Type-Options $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx)

Slide 17

Slide 17 text

X-Content-Type-Options ★ and <STYLE> reject responses with incorrect content-types ★ Prevent MIME confusion ★ Implemented in Chrome, IE

Slide 18

Slide 18 text

X-Frame-Options $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx)

Slide 19

Slide 19 text

X-Frame-Options ★ Prevents content from being framed ★ Protects from external clickjacking ★ Three choices: DENY , SAMEORIGIN , or ALLOW-FROM

Slide 20

Slide 20 text

X-XSS-Protection $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx)

Slide 21

Slide 21 text

X-XSS-Protection ★ Browser’s best guess about blocking XSS attempts ★ On by default in Chrome, IE

Slide 22

Slide 22 text

Further Reading On OWASP: ★ List of Useful Headers ★ HTTP Strict Transport Security ★ Content Security Policy

Slide 23

Slide 23 text

Thank you! rj zaworski · @rjzaworski · github.com/rjz