Preventing web browsers from doing what attackers tell them to
Content Security Policy
I first mentioned Content Security Policy back in April 2009  as an experimental project. The good news is that WebKit-based browsers (Chrome and Safari), Gecko (Firefox, Thunderbird, and SeaMonkey) and Internet Explorer 10 have partial support . If you want to use it, you'll need to specify three headers to be on the safe side:
X-WebKit-CSP, which are used by various browsers and various versions.
If supported, however, the Content Security Policy supports extremely fine grained access permissions. You can specify from where resources like scripts, objects (plugins), stylesheets, images, media, frames, fonts, forms, and so on can be loaded and even specify a
report-uri that tells the web browser where to send information about policy violations. Thus, if a third-party website attempts to trigger a browser to loading protected content that is not permitted, you can in theory be informed by the client, which would allow you to track which sites are being used to attack you.
Unfortunately, most of these security headers are not widely used. For the top 1 million websites (according to Alexa), one report states that roughly 20,000 sites use the
X-Frame-Options header, about 4,000 use the
Access-Control-* headers, about 1,400 use the Strict Transport Security headers to enforce HTTPS, and approximately 100 use Content Security Policies . Saying that these security headers are not widely used is an understatement. Obviously, better support in clients would help, but one area in which support for these headers seems to be really lacking is in most web applications and frameworks. Much like SELinux and other security policies, they'll remain a niche item until things hit a critical mass.
- Chromium STS: http://dev.chromium.org/sts
- The X-Frame-Options response header: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
- HTTP access control: https://developer.mozilla.org/en/docs/HTTP/Access_control_CORS
- "Web Browser Security" by Kurt Seifried, Linux Pro Magazine, April 2009, pg. 64: http://www.linuxpromagazine.com/Issues/2009/101/Security-Lessons
- Content Security Policy: https://www.owasp.org/index.php/Content_Security_Policy
- Security Headers on Top 1,000,000 Websites: March 2013 Report: http://www.veracode.com/blog/2013/03/security-headers-on-the-top-1000000-websites-march-2013-report/
Buy this article as PDF
Powerful man-in-the-middle attack is now targeting online shopping.
Another high-profile coder says the kernel team needs a kinder, gentler culture.
Bug database has a bug of its own that could allow an intruder to create an unauthorized account.
Report focuses federal resources on achieving universal Internet access.
Leading browser makers say “no” to porous encryption algorithm
Report from the X-Force group says attackers are using TOR to hide their crimes
Future Firefox extensions will be compatible with Chrome.
Better read this if you bought your computer before 2011
Users should upgrade to the new version as soon as possible
Xen project announces a privilege escalation problem for Qemu host systems