Pushing CSP to PROD: Case Study of a Real-World Content-Security Policy Implementation
Video of session:https://www.youtube.com/watch?v=9V64zQi2pX0&list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU&index=33
Our story will arm you with the knowledge you’ll want should you decide to go down the same path. When we initially decided to implement CSP, the BETA version of our website was already live. Like many sites, our platform grew from something we initially started as a pet project. Admittedly, building CSP into our site from day one would have been much easier...but not nearly as challenging or fun.
We’ll start by walking you through our Content Security Policy, discuss the basic nuances between how each major browser implements CSP, and outline techniques for how we deal these nuances at runtime.
Lastly, we’ll discuss what we learned from implementing a notification mechanism to report violations of our CSP at runtime. Needless to say we were surprised by what was reported, and we’ll share the results.
Our hope is that by telling our story to the world, we’ll either save the rainforest or make your life a little easier should you decide to implement CSP (worst case scenario we’ll save you the trouble and dissuade you from even trying).
Gotham Digital Science
Brian is a founding member of Gotham Digital Science. He has over 10 years of experience performing penetration testing and code review. Brian is also the team lead for SendSafely, an browser based encrypted file exchange platform. Brian has spoken at numerous security conferences including BlackHat, RSA, AppSec USA, Source Boston and Shmoocon.
Erik is a professional Java developer. In addition to writing code, Erik also consults with other developers on how to identify security flaws through code review and secure development patterns. | | Java Developer for SendSafely.com and Secure Development Consultant with Gotham Digital Science
Attendance numbers do not account for private attendees. Get there early!
Remove this from your schedule?
This session is full and you may not be able to get back in.