Hacker News Reader

Comment by ATsch | Hacker News Reader

I think it's pretty unfortunate that even now, CSPs are getting so little love in the comments of a post where they would have easily prevented this script from loaded at all, and could have helped the author discover the script the second it was added.

For the unitiated, Content Security Policies (CSP) allow you to, among other things, define a whitelist of origins for things like scripts, css etc. and also notify you of violations. There is little excuse to not set a strong CSP on your sites if you can and you'll be glad you have it once something does happen.

View on HN

Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0].

[0]: https://twitter.com/JackyHallyday/status/968263408003973121

Nothing can save you if you don't trust your hosting provider, or don't use HTTPS.

However, "was caught" is important :) The more noise they make the more likely they are to get caught.

> There is little excuse to not set a strong CSP on your sites

true, but

> if you can

IIRC that excludes every website with Google Adsense and even just using a manual ad network includes always fiddling with your CSP.

> There is little excuse to not set a strong CSP on your sites

Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd love to securely monetize a few webapps of mine.

Anyone using either of those doesn't care about user security and privacy anyway.

How would a CSP have helped here? GoDaddy injects that additional script tag right into the HTML file it serves. No policy will help if the web server does not serve what you uploaded.

The browser wouldn't have loaded the linked JS file. This is exactly the attack that CSP is designed to thwart.

Then again, GoDaddy could just rewrite your headers.

That's not true. CSP can have a specific host/path for scripts and won't even run JS in the page without explicitly opting in to 'unsafe-inline'. It's an important prevention technique against XSS for pages showing user generated content.

My point is that if GoDaddy modifies the HTTP body, they could as well modify the CSP you send in the HTTP header. It is yet another stop-gap, but the real solution is to get a hoster you can trust.

You can also make this assignment throw:

    window.tcg = ...

And the script will do nothing.

Isn't the script injected inline in the HTML here? I have only little experience with CSP but wouldn't it only prevent from loading external scripts?

CSP affects inline scripts as well. They are actually disallowed by default and must be explicitly whitelisted.

Reply on news.ycombinator.com