Content Security Policy Evolution: From Whitelists to Strict-Dynamic - AppSec EU 2017

Explore the flaws in Content Security Policy's whitelist-based approach and discover an alternative using 'strict-dynamic' with nonces or hashes in this 35-minute conference talk from AppSec EU 2017. Learn about the implementation of effective policies in major Google products like Gmail and Photos. Gain insights into best practices, common pitfalls, and strategies for addressing recent bypasses of nonce-based policies. Delve into topics such as CSP support in core frameworks, auto-noncing with Closure Templates, and tools like CSP Mitigator and Evaluator. Understand the challenges of nonce exfiltration, reuse techniques, and dangling markup attacks while exploring detailed CSP violation reports and measuring coverage.

Intro
Summary
Recap: How do CSP Nonces Work?
Recap: What is 'strict-dynamic'?
CSP Support in Core Frameworks
One Policy to Rule Them All!
Closure Templates with auto-noncing
SHIP IT !!1
New 'report-sample' keyword
Report Noise
CSP Mitigator
CSP Evaluator
CSP Frontend
Detailed CSP Violation Reports View
Measuring Coverage
Injection of
Steal and Reuse Nonces
Mitigating Bypasses
JS Framework/Library CSP Bypasses
jQuery 2.x Script Evaluation Logic
Wrapping Up