In this section, we'll explain what content security policy is, and describe how CSP can be used to mitigate against some common attacks.
CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages.
To enable CSP, a response needs to include an HTTP response header called
Content-Security-Policy with a value containing the policy. The policy itself consists of one or more directives, separated by semicolons.
The following directive will only allow scripts to be loaded from the same origin as the page itself:
The following directive will only allow scripts to be loaded from a specific domain:
Care should be taken when allowing scripts from external domains. If there is any way for an attacker to control content that is served from the external domain, then they might be able to deliver an attack. For example, content delivery networks (CDNs) that do not use per-customer URLs, such as
ajax.googleapis.com, should not be trusted, because third parties can get content onto their domains.
In addition to whitelisting specific domains, content security policy also provides two other ways of specifying trusted resources: nonces and hashes:
It's quite common for a CSP to block resources like
script. However, many CSPs do allow image requests. This means you can often use
img elements to make requests to external servers in order to disclose CSRF tokens, for example.
Some browsers, such as Chrome, have built-in dangling markup mitigation that will block requests containing certain characters, such as raw, unencoded new lines or angle brackets. In this next lab, you'll need to get round these Chrome restrictions and make an external request using a different element and attribute.
Some policies are more restrictive and prevent all forms of external requests. However, it's still possible to get round these restrictions by eliciting some user interaction. To bypass this form of policy, you need to inject an HTML element that, when clicked, will store and send everything enclosed by the injected element to an external server.
The following directive will only allow images to be loaded from the same origin as the page itself:
The following directive will only allow images to be loaded from a specific domain:
Note that these policies will prevent some dangling markup exploits, because an easy way to capture data with no user interaction is using an
img tag. However, it will not prevent other exploits, such as those that inject an anchor tag with a dangling
You may encounter a website that reflects input into the actual policy, most likely in a
report-uri directive. If the site reflects a parameter that you can control, you can inject a semicolon to add your own CSP directives. Usually, this
report-uri directive is the final one in the list. This means you will need to overwrite existing directives in order to exploit this vulnerability and bypass the policy.
Normally, it's not possible to overwrite an existing
script-src directive. However, Chrome recently introduced the
script-src-elem directive, which allows you to control
script elements, but not events. Crucially, this new directive allows you to overwrite existing
script-src directives. Using this knowledge, you should be able to solve the following lab.
The following directive will only allow the page to be framed by other pages from the same origin:
The following directive will prevent framing altogether:
Using content security policy to prevent clickjacking is more flexible than using the X-Frame-Options header because you can specify multiple domains and use wildcards. For example:
frame-ancestors 'self' https://normal-website.com https://*.robust-website.com
CSP also validates each frame in the parent frame hierarchy, whereas
X-Frame-Options only validates the top-level frame.
Using CSP to protect against clickjacking attacks is recommended. You can also combine this with the
X-Frame-Options header to provide protection on older browsers that don't support CSP, such as Internet Explorer.