Tweet
Tweet

Slide 1

Slide 1 text

OWASP Russia Meetup #3 Web Application Security: future standards and technologies

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

Web Application Security Working Group The mission of the Web Application Security Working Group, part of the Security Activity, is to develop security and policy mechanisms to improve the security of Web Applications, and enable secure cross-origin communication. http://www.w3.org/2014/12/webappsec-charter-2015

Slide 5

Slide 5 text

Agenda ● CSP2 (very shortly) ● Subresource Integrity ● Referrer Policy ● Credential Management API ● Confinement with Origin Web Labels ● Entry Point Regulation for Web Applications

Slide 6

Slide 6 text

CSP2 ● www.w3.org/TR/CSP2/ ● nonces & hashes!!!11111 ● frame-ancestors to replace X-Frame- Options ● unsafe-redirect ● The CSP HTTP Request Header ● More information in violation reports

Slide 7

Slide 7 text

CSP2 nonces Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com 'nonce- Nc3n83cn...9hc3' alert("Allowed because nonce is valid.")

Slide 8

Slide 8 text

Subresource Integrity ● www.w3.org/TR/SRI/ ● Integrity verification via cryptographic hash

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

RefeRRer Policy ● www.w3.org/TR/referrer-policy/ ● ● None, None when downgrade, Origin Only, Origin when cross-origin, Unsafe URL

Slide 11

Slide 11 text

Credential Management API ● www.w3.org/TR/credential-management-1/ ● Allow websites to more directly interact with the user agent’s credential manager ● Help to detect sign-in via a third-party ● Changing Password

Slide 12

Slide 12 text

Password-based Sign-in navigator.credentials.get({ "types": [ "password" ] }).then( function(credential) { if (!credential) { // show basic form return; } if (credential.type == "PasswordCredential") { credential.send("https://example.com/login") .then(function (response) { // signin succeeded! }); } else { // See the Federated Sign-in example } });

Slide 13

Slide 13 text

And the last... ● Confinement with Origin Web Labels ● Entry Point Regulation for Web Applications ● Permissions API ● Suborigin Namespaces ● Mixed Content ● User Interface Security Directives for Content Security Policy

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Thanks! mailto:oxdef@oxdef.info