Hacker News Reader

Comment by niftich | Hacker News Reader

Though I am not familiar with this particular project and can't comment on its quality, a C-S-P directive engine is always welcome.

In my opinion [1][2][3], it's fairly clear that C-S-P isn't a fire-and-forget header (unlike some other Security Headers) and that its generation needs to take into account rules that can be set up ahead of time and the context of the resource in question. The OWASP wiki page itself recommends this, but as far as I know, no web framework implements this.

If you know otherwise, let me know. This may be the first.

[1] https://news.ycombinator.com/item?id=12584356#12584733 [2] https://news.ycombinator.com/item?id=12408328#12408680 [3] https://news.ycombinator.com/item?id=13055470#13057260

View on HN

If you generate them on-demand based on the resources included in the page how can you ensure that XSS attacks on the page aren't going to result in hostile sources being included in the CSP headers? I'm curious as to what the rules would look like that define a fluid list of sources that can be expanded based on page content but not vulnerable to inline XSS attacks.

Generally with these things, avoiding user input is one of the best ways at making sure they can't inject things into the header value.

I'd recommend manually writing the list of sources for the page type. There isn't really a safe way to just scan the page for (safe) resources unfortunately (how could you tell which resources were meant to be there?)

Point of the (CSP) part of this class is to let you break down your CSP into distinct components and then combine them together.

E.g. You need to embed a tweet – that twitter embed code will require you to add script, style, and image sources to your CSP. You could file them all quite nicely in the CSP array format, and call that variable `$twitterCSP`.

If twitter changes things in the future RE the required sources, you now know what to amend. If you decide you no longer want tweets on your page, you can get rid of unnecessary sources by deleting just `$twitterCSP` from your code – instead of leaving in sources you don't need, or having to trudge through the entire CSP string trying to figure out which sources you added to make twitter work.

Goal is source management, not auto generating the list.

Reply on news.ycombinator.com