Re: FW: Java Script Client

As nearly as I can tell, the main goal of the Content Security Policy meta tag is to prevent XSS. But they carefully, and correctly, assert that it does not actually fully prevent XSS. And the caveats  about what it does and does not prevent are so complicated that the only safe policy is to conduct rigorous XSS hygiene on the content you display anyway. I.e., you should turn it on, but then you must assume that it does not work.

It could be argued that CSP will increase vulnerability to XSS, since it may lure programming teams into taking XSS less seriously, and enforcing the necessary hygiene less vigorously.

But if you treat it as a last resort backup to the work you need to do anyway, work you may have done incorrectly despite your best efforts, CSP may do more good than harm.

--marcs

From: [email protected] [mailto:[email protected]] On Behalf Of Tony Arcieri
Sent: Tuesday, May 27, 2014 9:17 AM
To: General discussions concerning capability systems.
Subject: Re: [cap-talk] FW: Java Script Client

On Mon, May 26, 2014 at 11:25 PM, Dean Tribble <[email protected]<mailto:[email protected]>> wrote:
JavaScript with strict-mode code. That's where the most modern activity for secure client code is.

See also:

- Content Security Policy
- <iframe sandbox> and postMessage()
- Cross-Origin Resource Sharing

--
Tony Arcieri

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk