HTTP Security

Transcript

1. HTTP Security A matter of trust rj zaworski, versal inc. · @rjzaworski · github.com/rjz
2. Browsers ★ Do what servers tell them to ★ Respect standards (mostly) ★ Render as much of the server response as they can
3. Trust is a Big Deal ★ Servers can be compromised, impersonated, or simply misconfigured ★ How can we tell if content is trustworthy? The short answer is, “we can’t”.
4. HTTP can help $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block
5. Transport Security $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (https://tools.ietf.org/html/rfc6797)
6. Transport Security ★ Ensure the browser never visits the http version of a website ★ Force transport-layer security (TLS)
7. Transport Security Why bother? ★ eavesdropping ★ man in the middle (data tampering, host spoofing, etc)
8. Transport Security ★ Protects from common wireless attacks (spoofing, sniffing, e.g. SSLStrip + Firesheep) ★ Protects from mixed-content errors (CSS, SWF)
9. Content Security Policies $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (https://w3c.github.io/webappsec/specs/content-security-policy/)
10. Content Security Policies ★ Helps detect/prevent XSS, mixed-content, and other classes of attack ★ Whitelist what is or isn't allowed on a page ★ Describe access to specific types of content in terms of directives
11. Content Security Policies ★ Implemented via HTTP header ★ or a <META> tag <meta http-equiv="Content-Security-Policy" content="script-src 'self'">
12. Content Security Policies Some directives: ★ default-src - define base policy ★ script-src - define valid origins for <script> tags ★ connect-src - XHRs, WebSocket and EventSource ★ form-action - form actions
13. Content Security Policies ★ Policies may be layered ★ Policies are restrictive A request must pass all announced policies to be served!
14. Content Security Policies Report-Only: log without enforcing Content-Security-Policy-Report-Only: \ default-src 'self'; \ report-uri https://test.versal.com/csp-reports Looks familiar...
15. Content Security Policies Risks: ★ CSS Parsing is still vulnerable ★ Browser support is incomplete
16. X-Content-Type-Options $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx)
17. X-Content-Type-Options ★ <SCRIPT> and <STYLE> reject responses with incorrect content-types ★ Prevent MIME confusion ★ Implemented in Chrome, IE
18. X-Frame-Options $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx)
19. X-Frame-Options ★ Prevents content from being framed ★ Protects from external clickjacking ★ Three choices: DENY , SAMEORIGIN , or ALLOW-FROM
20. X-XSS-Protection $ curl https://twitter.com -I status: 200 OK # ... strict-transport-security: max-age=631138519 content-security-policy-report-only: default-src https:; #... x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block (http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx)
21. X-XSS-Protection ★ Browser’s best guess about blocking XSS attempts ★ On by default in Chrome, IE
22. Further Reading On OWASP: ★ List of Useful Headers ★ HTTP Strict Transport Security ★ Content Security Policy
23. Thank you! rj zaworski · @rjzaworski · github.com/rjz