Why Is CSP Failing? Trends and Challenges in CSP Adoption

Abstract

Abstract. Content Security Policy (CSP) has been proposed as a principled and robust browser security mechanism against content injection attacks such as XSS. When configured correctly, CSP renders malicious code injection and data exfiltration exceedingly difficult for attackers. However, despite the promise of these security benefits and being implemented in almost all major browsers, CSP adoption is minuscule-our measurements show that CSP is deployed in enforcement mode on only 1% of the Alexa Top 100. In this paper, we present the results of a long-term study to determine challenges in CSP deployments that can prevent wide adoption. We performed weekly crawls of the Alexa Top 1M to measure adoption of web security headers, and find that CSP both significantly lags other security headers, and that the policies in use are often ineffective at actually preventing content injection. In addition, we evaluate the feasibility of deploying CSP from the perspective of a security-conscious website operator. We used an incremental deployment approach through CSP's report-only mode on four websites, collecting over 10M reports. Furthermore, we used semi-automated policy generation through web application crawling on a set of popular websites. We found both that automated methods do not suffice and that significant barriers exist to producing accurate results. Finally, based on our observations, we suggest several improvements to CSP that could help to ease its adoption by the web community.

Semantics-Based Analysis of Content Security Policy Deployment

“…There are many important differences between the present paper and this previous work [23,35]. First, the focus of the works is quite different, since we are only interested in assessing the trends and the effectiveness of the current CSP adoption, while [23,35] put great emphasis on semi-automated policy generation.…”

“…It is interesting to observe that an earlier study [35] conducted in March 2014 identified only 850 websites using CSP in the Alexa Top 1M, hence the CSP adoption has significantly expanded in the last two years, approximately of a ten factor. An inspection of our dataset shows that a number of popular hosting services have deployed CSP nowadays, including Blogger, Tumblr and Shopify among others.…”

“…However, previous studies assessed that moving inline scripts to external resources is not a trivial task [34] and showed that the large majority of the websites deploying CSP just resorts to activating 'unsafe-inline' [35]. Nonces and hashes have been introduced in CSP Level 2 to give web developers the possibility of white-listing individual inline scripts and stylesheets.…”

“…After assessing a limited adoption of the standard, the authors proposed a tool, UserCSP, to automatically synthesise content security policies for existing websites. This is not the only available study, because Weissbacher, Lauinger and Robertson [35] proposed a more recent and in-depth analysis of the CSP deployment on the Alexa Top 1M in March 2014. The authors then discussed challenges in the CSP adoption and techniques for semi-automated policy generation.…”

May I? - Content Security Policy Endorsement for Browser Extensions

“…This makes the endorsement mechanism compatible with both CSP 1.0 and CSP 2.0. Weissbacher et al [39] measure a low deployment rate of CSP and conduct studies to analyze the practical challenges for deploying CSP policies. They point out that it is di cult to define a policy for a web page that utilizes the full potential of CSP.…”