Preventing web browsers from doing what attackers tell them to
Content Security Policy
I first mentioned Content Security Policy back in April 2009  as an experimental project. The good news is that WebKit-based browsers (Chrome and Safari), Gecko (Firefox, Thunderbird, and SeaMonkey) and Internet Explorer 10 have partial support . If you want to use it, you'll need to specify three headers to be on the safe side:
X-WebKit-CSP, which are used by various browsers and various versions.
If supported, however, the Content Security Policy supports extremely fine grained access permissions. You can specify from where resources like scripts, objects (plugins), stylesheets, images, media, frames, fonts, forms, and so on can be loaded and even specify a
report-uri that tells the web browser where to send information about policy violations. Thus, if a third-party website attempts to trigger a browser to loading protected content that is not permitted, you can in theory be informed by the client, which would allow you to track which sites are being used to attack you.
Unfortunately, most of these security headers are not widely used. For the top 1 million websites (according to Alexa), one report states that roughly 20,000 sites use the
X-Frame-Options header, about 4,000 use the
Access-Control-* headers, about 1,400 use the Strict Transport Security headers to enforce HTTPS, and approximately 100 use Content Security Policies . Saying that these security headers are not widely used is an understatement. Obviously, better support in clients would help, but one area in which support for these headers seems to be really lacking is in most web applications and frameworks. Much like SELinux and other security policies, they'll remain a niche item until things hit a critical mass.
- Chromium STS: http://dev.chromium.org/sts
- The X-Frame-Options response header: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
- HTTP access control: https://developer.mozilla.org/en/docs/HTTP/Access_control_CORS
- "Web Browser Security" by Kurt Seifried, Linux Pro Magazine, April 2009, pg. 64: http://www.linuxpromagazine.com/Issues/2009/101/Security-Lessons
- Content Security Policy: https://www.owasp.org/index.php/Content_Security_Policy
- Security Headers on Top 1,000,000 Websites: March 2013 Report: http://www.veracode.com/blog/2013/03/security-headers-on-the-top-1000000-websites-march-2013-report/
Buy this article as PDF
News site for the openSUSE community falls victim to a Wordpress exploit.
The source code is available online.
One out of three virtual machines on Microsoft Azure Cloud run Linux.
The form factor of the board makes it a drop-in replacement for Raspberry Pi.
Makes it easier for customers to move workloads into container-centric applications.
SUSE’s answer to container-centric operating systems.
Linux 4.9 is the biggest release in terms of number of commits.
The latest version of the official RHEL clone is here.
New release targets Linux professionals.
The Fedora project adds Wayland and Gnome 3.22