AppSec EU 2017 So We Broke All CSPs You Won't Guess What Happened Next by Michele Spagnuolo
Why Stack Overflow recommends it
Stack Overflow users link it when explaining how CSP nonces and 'strict-dynamic' actually behave and why Google moved away from whitelists.
Recommended by 2 people across 2 different months, 2020 to 2021.
What it is
A 35-minute OWASP AppSec EU 2017 talk by Michele Spagnuolo of Google on why whitelist-based Content Security Policies are broadly bypassable and how 'strict-dynamic' with nonces or hashes works as a replacement. It covers Google's deployment on products like Gmail and Photos, common pitfalls, and newer attacks such as nonce exfiltration and dangling markup.
What people said
Recommends Juraj Martinka · 2021-04 · Stack Overflow · on “Why doesn't google.com use CSP?”
While their might now use it on google.com they are using it a lot of places - e.g. meet.google.com. See [LINK] - they reference this great talk: [this video]
Recommends granty · 2021-05 · Stack Overflow · on “CSP: Does browser check if the nonce value in header matches with the nonce value in script tag?”
Yes, browser exactly check matches nonce values in the header and in the script tag. But jQuery 2.x (unintentionally) uses a technique to bypass 'nonce-value' via 'unsafe-eval' (you had to allow evalfor that). This framework brokes all logics of placing scripts in the HTML code. jQuery 2.x parses all <script>...</script> tags from the HTML and puts it in a dynamically generated script tag or executes those through eval( ) : [LINK] That's why Dropbox performs manual checking of nonce for jQuery 2.x: [LINK] More details you can find in this video [this video] from AppSec EU 2017 (already rewinded to the required moment).
Cites Christian · 2020-08 · Stack Overflow · on “CSP: Why is document.createElement("script") good and document.write("<script ...") bad?”
I'm just a bit confused. I've been going through a presentation slide deck on Content Security Policies [LINK] . On slide 10, when discussing the 'strict-dynamic' directive, three examples are given: one good, two bad: // good <script nonce="r4nd0m"> var s = document.createElement("script"); s.src = "//example.com/bar.js"; document.body.appendChild(s); </script> // bad <script nonce="r4nd0m"> var s = "<script src=//example.com/bar.js></script>"; document.write(s); // -OR- document.body.innerHTML = s; </script> Google also advises to make similar changes on their CSP page [LINK] ("Refactor calls to JS APIs incompatible with CSP"). I understand that the good example loads async while the bad o