Evaluating the Effectiveness of Content Security Policy in the Wild

Explore the effectiveness of Content Security Policy (CSP) in real-world scenarios through this conference talk presented at CCS 2016. Delve into the intricacies of CSP, examining its implementation, browser support, and potential inconsistencies. Analyze the adoption rates, configuration practices, and the evolution of CSP deployment. Gain insights into harsh policies and their impact on cross-site scripting (XSS) vulnerabilities. Learn about the research goals, methodologies, and key findings presented by authors from Università Ca' Foscari Venezia, offering a comprehensive evaluation of CSP's role in addressing content security problems.

Syllabus

Intro
Content Security Policy
Example
More on Inline Scripts
Research Goals
] Browser Support for CSP
] Enforcing Multiple Policies
[RQ1] Inconsistent Behaviours
Adoption of CSP
] Main Findings
] Configuration of CSP
] Harsh Policies
[RQ3] Defining Weakness to XSS
[RQ3] Weakness to XSS
] Evolution of CSP Deployment