Write a policy

Back to the guest list. A good host does not write "anyone in a nice coat". They look at who is actually invited and write those names, and nobody else. Here you do the same: look at what the page really loads, and allow exactly that.

The attack to stop

In Module 10 an attacker's text on a practice page carried script: a <script> block in the guestbook (Lesson 58), an <img onerror> that slipped past the toy filter (Lesson 61), and pretend code that sent cookies to prize.example (Lesson 62). Escaping fixed those. Here you add the second line, in case one spot is ever missed. Injected code usually arrives in one of three shapes, and the practice pages here contain all three:

• an inline <script>...</script> block;
• an inline event handler, an attribute such as onerror="..." on an image tag;
• a <script src="https://prize.example/x.js"> pointing at the attacker's server.

A good policy blocks all three, and still lets the page load its own app script, its style sheet, its images, its payment library, its video frame and its one inline script.

The practice page and the checker

practice_site(seed) from watched.leg3a_csp returns a page as a dict: its origin and a list of resources. Each resource has a kind (script, style, img, font, connect, frame), either a url or inline: True, and injected, which is True for the attacker's three. The page's own inline script carries a nonce: a random value only the real server knows (Lesson 66 explains it fully).

{"kind": "script", "url": "https://pay.example/lib.js", "injected": False}
{"kind": "script", "inline": True, "nonce": "y334r23xgecgnryn", "injected": False}
{"kind": "script", "inline": True, "handler": True, "injected": True}

evaluate(policy, page) plays the browser. It returns broken (needed resources your policy blocks) and attacks_run (injected ones it lets through). You want both empty. print_report(policy, page) from watched.leg3d_csp_more prints the same thing readably.

A plan

1. Start every directive with 'self', so your own files load.
2. For each needed outside URL, add its scheme and host, such as https://pay.example, to the directive for its kind. Not https: and not *: those let prize.example in too.
3. For the page's own inline script, add 'nonce-VALUE' to script-src. Never 'unsafe-inline'.
4. End with default-src 'self' for everything else, plus object-src 'none', base-uri 'none' and frame-ancestors 'none', which cost nothing on a page that needs none of them.

Notice what this does to the event handler: no source you can add allows onerror= attributes except 'unsafe-inline', so leaving that keyword out blocks them all. Notice too that each kind gets its own list. If your page fetches data from api.example, that host belongs in connect-src, not script-src; otherwise an attacker who can upload a file there could run it as a script.

A common misconception: "script-src https: is strict because it forces HTTPS". It only forces the scheme. Any attacker can host a script on an HTTPS address.

// JavaScript (Express)
app.use((req, res, next) => {
  res.set("Content-Security-Policy", "default-src 'self'; object-src 'none'; base-uri 'none'");
  next();
});

// Go (net/http)
w.Header().Set("Content-Security-Policy", "default-src 'self'; object-src 'none'; base-uri 'none'")

// PHP
header("Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none'");

# nginx
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'none'" always;