[websec] Call for review of Content Security Policy 1.0

"Hill, Brad" <bhill@paypal-inc.com> Tue, 04 September 2012 23:00 UTC

DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To: Subject:Thread-Topic:Thread-Index:Date:Message-ID: Accept-Language:Content-Language:X-MS-Has-Attach: X-MS-TNEF-Correlator:x-originating-ip:Content-Type: Content-Transfer-Encoding:MIME-Version:X-CFilter; b=qlHrSVJ/4LPqaVlDjqNgLnU6D+OoeKTIBcdhS1rizOhEeEKIED/hI3sb uvUljgfdcMToKqrRiLQ2Ti0YY82/cW1Fyj7zwlvwhiLrS9COSujXgWzv6 dgJiOyHCgzMke/z;
From: "Hill, Brad" <bhill@paypal-inc.com>
To: "websec@ietf.org" <websec@ietf.org>
Thread-Topic: Call for review of Content Security Policy 1.0
Thread-Index: Ac2K8Q+9qgls1oZjSieX7Gz7Krupmg==
Date: Tue, 04 Sep 2012 23:00:21 +0000
Message-ID: <370C9BEB4DD6154FA963E2F79ADC6F2E23634D@DEN-EXDDA-S12.corp.ebay.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [websec] Call for review of Content Security Policy 1.0
Precedence: list

The Web Application Security Working Group at the W3C is planning to advance Content Security Policy 1.0 to Candidate Recommendation - a final set of features and syntax - and is seeking wide review of the document at this time. We would especially value the input of members of the IETF WebSec list.

http://www.w3.org/TR/2012/WD-CSP-20120710/

Content Security Policy is a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). Content Security Policy is a declarative policy that lets the authors (or server administrators) of a web application restrict from where the application can load resources.

To mitigate XSS, for example, a web application can restrict itself to loading scripts only from known, trusted URIs, making it difficult for an attacker who can inject content into the web application to inject malicious script.

Content Security Policy (CSP) is not intended as a first line of defense against content injection vulnerabilities. Instead, CSP is best used as defense-in-depth, to reduce the harm caused by content injection attacks.

There is often a non-trivial amount of work required to apply CSP to an existing web application. To reap the greatest benefit, authors will need to move all inline script and style out-of-line, for example into external scripts, because the user agent cannot determine whether an inline script was injected by an attacker.

To take advantage of CSP, a web application opts into using CSP by supplying a Content-Security-Policy HTTP header Such policies apply the current resource representation only. To supply a policy for an entire site, the server needs to supply a policy with each resource representation.

Please submit comments to public-webappsec@w3.org

Thank you,
Brad Hill
Co-Chair
W3C Web Application Security WG

[websec] Call for review of Content Security Poli… Hill, Brad