4 ms·
Has anyone demonstrated XSS attacks that work even when CSP is properly configured? Seems like all discussion of XSS now-a-days should be preceded with a note
by altano 11y ago
Has anyone demonstrated XSS attacks that work even when CSP is properly configured? Seems like all discussion of XSS now-a-days should be preceded with a note that you should go turn on CSP before worrying about any other form of prevention.
- seiji 11y agoDoesn't that depend on browser vendors supporting and properly implementing CSP? What about every embedded device browser that will never receive an update? Does your toaster, fridge, microwave, and toilet get security updates?
- david_shaw 11y agoFrom what I've seen, no -- but that depends what you mean by "properly configured." If you look at challenges like this ( https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22 https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minicha... ), you'll see that CSP appears to be properly configured, but there are actually ways to bypass. It's problems like this that I've seen "in the wild" most of the time. The other side of the argument is that not many people are building web applications with CSP built-in from the beginning. If you don't start development with CSP in mind, it can become very cumbersome to put CSP into place (outside of report-only mode). As a result, a lot of people are currently using CSP as just report-only analytics on potential violations.