CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy

Weichselbaum, L., Spagnuolo, M., Lekies, S., & Janc, A. (2016). CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy. ACM.

Type

Conference paper

Intellectual base

Primary research

Year

2016

DOI

10.1145/2976749.2978363

DOI registrant

Association for Computing Machinery

Link

https://doi.org/10.1145/2976749.2978363

Cited by

1 citation across 1 artifact.

Domain-specific

• Cross-Site Scripting
  • Google security engineers (Weichselbaum, Spagnuolo, Lekies, and Janc; ACM CCS 2016, "CSP Is Dead, Long Live CSP!") analysed Content Security Policy across a large sample of the web, found host-allowlist CSPs largely ineffective against XSS, and promoted nonce-/hash-based "strict" CSP as a blast-radius cap that blocks injected scripts even when an encoding lapse lets bytes through

    SupportedVerified against the source

    Read by an automated reader; not a human review. How support was checked

Verification

Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.

Does it back the claim? Read against the text for 1 of 1 citation: 1 supported. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Registry ID ref:cc8e0e08f6d6 · see in the full table