CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy

Weichselbaum, L., Spagnuolo, M., Lekies, S., & Janc, A. (2016). CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy. ACM.

Type

Conference paper

Intellectual base

Primary research

Year

2016

DOI

10.1145/2976749.2978363

Link

https://doi.org/10.1145/2976749.2978363

Cited by

1 citation across 1 artifact.

Domain-specific

• Cross-Site Scripting
  • Google security engineers (Weichselbaum, Spagnuolo, Lekies, and Janc; ACM CCS 2016, "CSP Is Dead, Long Live CSP!") analysed Content Security Policy across a large sample of the web, found host-allowlist CSPs largely ineffective against XSS, and promoted nonce-/hash-based "strict" CSP as a blast-radius cap that blocks injected scripts even when an encoding lapse lets bytes through

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:cc8e0e08f6d6 · see in the full table