Content Security Policy CSP

What is Content Security Policy?

Content Security Policy is internet security standard to prevent the known attack like Cross-site scripting XSS, click hijacking and code injection. For example like, if your visiting website is http://www.example.com  then you only able to access the data come from http://www.example.com, others URL or script and CDN like http://google.com/jquery.js also will be blocked.

Beside that, it also contain some inline script <button onclick="testing()">Click Me!</button> will also be blocked. unless you do some configuration on the header.


In short, it will do the following:
1) Whitelist to tell the client (Normally is Browser) what's allowed and what is not allowed.
2) Learn what directives are available
3) Learn the keywords they take
4) Inline code and eval () are considered harmful
5) Report Policy violations to your server before enforcing them.

How to implement Content Security Policy (CSP)?

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Content-Security-Policy" value="default-src 'self';" />
    </customHeaders>
  </httpProtocol> 
</system.webServer> 

Above is the method to do the CSP on IIS, you need to add the following to the Web.config, this will cause the website only allows the source which is self. (In another world mean the website itself.)


Besides the value default-src, there are various more directives references.

• base-uri restricts the URLs that can appear in a page's <base> element.
• child-src lists the URLs for workers and embedded frame contents. For example: child-src https://youtube.com would enable embedding videos from YouTube but not from other origins. Use this in place of the deprecated directiveframe-src.
• connect-src limits the origins that you can connect to (via XHR, WebSockets, and EventSource).
• font-src specifies the origins that can serve web fonts. Google's web fonts could be enabled via font-src https://themes.googleusercontent.com.
• form-action lists valid endpoints for submission from <form> tags.
• frame-ancestors specifies the sources that can embed the current page. This directive applies to <frame>, <iframe>, <embed>, and <applet> tags. This directive can't be used in <meta> tags and applies only to non-HTML resources.
• frame-src deprecated. Use child-src instead.
• img-src defines the origins from which images can be loaded.
• media-src restricts the origins allowed to deliver video and audio.
• object-src allows control over Flash and other plugins.
• plugin-types limits the kinds of plugins a page may invoke.
• report-uri specifies a URL where a browser will send reports when a content security policy is violated. This directive can't be used in <meta> tags.
• style-src is script-src's counterpart for stylesheets.
• upgrade-insecure-requests instructs user agents to rewrite URL schemes, changing HTTP to HTTPS. This directive is for websites with large numbers of old URL's that need to be rewritten.