Content Security Policy (CSP)

Content Security Policy (CSP)

A commonly used method to abuse websites is the so-called Cross-Site Scripting (XSS). In this case, malicious software from outside is injected into one’s own site through a corresponding vulnerability – e.g. through insufficient validation of user form input.

The function of these scripts can do many things: from reading user input, e.g. during a log-in, distributing additional malicious software to site visitors, redirecting mouse clicks, to completely redesigning the existing page in order to misuse it for other purposes, almost anything is possible.

And how does CSP work?

The so-called Content Security Header (CSP) is intended to provide a remedy here. When CSP is used, additional header information is transmitted to the browser. In this way, the browser is informed about which sources content may be retrieved from and displayed at all.

By defining the permitted sources, the browser blocks the loading of all other sources that have not been explicitly allowed. This means it is no longer easily possible for a script from an unknown or unauthorized source to be loaded and executed in the browser.

The settings can be configured differently depending on the data type, so for example the permitted sources for scripts can be different from the permitted sources for images or stylesheet instructions.

Usually, a general configuration is made via the directive „default-src“, which can then be supplemented by directives such as „script-src“, „style-src“ etc.

How can CSP be activated?

The use of CSP headers can be implemented in several ways:

• Configuration of the web server
• via a .htaccess file
• via the Virtual Hosts configuration
• via meta tags in the header of the pages
• by using server-side scripting languages (e.g. PHP)

Preparation for use

Anyone dealing with the configuration of the CSP header will quickly realize how much content is actually retrieved externally. In particular, scripts that also load a lot of content, such as google maps, deserve special attention.

At this point, a recommendation:

To minimize the amount of CSP header configuration required in advance, the following recommendations apply:

• Avoid any external embedding if it can also be provided locally (e.g. fonts)
• Avoid inline Javascript code; wherever possible, move the code into separate files.

Have we piqued your interest?

You are welcome to contact us about this topic.

Write to us: info(at)e-pixler.com or call us: 030 220 5630 0

We are always there for you!