Preventing web browsers from doing what attackers tell them to
Content Security Policy
I first mentioned Content Security Policy back in April 2009 [4] as an experimental project. The good news is that WebKit-based browsers (Chrome and Safari), Gecko (Firefox, Thunderbird, and SeaMonkey) and Internet Explorer 10 have partial support [5]. If you want to use it, you'll need to specify three headers to be on the safe side: Content-Security-Policy
, X-Content-Security-Policy
, and X-WebKit-CSP
, which are used by various browsers and various versions.
If supported, however, the Content Security Policy supports extremely fine grained access permissions. You can specify from where resources like scripts, objects (plugins), stylesheets, images, media, frames, fonts, forms, and so on can be loaded and even specify a report-uri
that tells the web browser where to send information about policy violations. Thus, if a third-party website attempts to trigger a browser to loading protected content that is not permitted, you can in theory be informed by the client, which would allow you to track which sites are being used to attack you.
Conclusion
Unfortunately, most of these security headers are not widely used. For the top 1 million websites (according to Alexa), one report states that roughly 20,000 sites use the X-Frame-Options
header, about 4,000 use the Access-Control-
* headers, about 1,400 use the Strict Transport Security headers to enforce HTTPS, and approximately 100 use Content Security Policies [6]. Saying that these security headers are not widely used is an understatement. Obviously, better support in clients would help, but one area in which support for these headers seems to be really lacking is in most web applications and frameworks. Much like SELinux and other security policies, they'll remain a niche item until things hit a critical mass.
Infos
- Chromium STS: http://dev.chromium.org/sts
- The X-Frame-Options response header: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
- HTTP access control: https://developer.mozilla.org/en/docs/HTTP/Access_control_CORS
- "Web Browser Security" by Kurt Seifried, Linux Pro Magazine, April 2009, pg. 64: http://www.linuxpromagazine.com/Issues/2009/101/Security-Lessons
- Content Security Policy: https://www.owasp.org/index.php/Content_Security_Policy
- Security Headers on Top 1,000,000 Websites: March 2013 Report: http://www.veracode.com/blog/2013/03/security-headers-on-the-top-1000000-websites-march-2013-report/
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Endless OS 6 has Arrived
After more than a year since the last update, the latest release of Endless OS is now available for general usage.
-
Fedora Asahi 40 Remix Available for Macs with Apple Silicon
If you've been anticipating KDE's Plasma 6 for your Apple Silicon-powered Mac, then you're in luck.
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.