Using Content Security Policy to Make Apps More Secure | 60devs
Content Security Policy is a browser mechanism that helps to prevent cross-site scripting (XSS) attacks. What is XSS? It’s a kind of attack when an attacker injects some client-side script into a web page in order to get access to the secret data or inject other malicious software. Once the injected script gains the access to the page, it needs to send the data to or somehow communicate with the a
Mozillaの報奨金制度で100万円ほど稼いだ話
This document summarizes Content Security Policy (CSP), a browser feature that helps mitigate cross-site scripting and other attacks. It discusses CSP's directives for controlling resource loading, browser support, syntax, and violation reporting. It also notes potential issues with abuse of CSP violation reports if not properly validated and formatted on the server-side.
How HTML Injection Is Bad on Firefox OS
1101158.md How HTML Injection Is Bad on Firefox OS 「Firefox OS Advent Calendar 2014」と「脆弱性"&'<<>\ Advent Calendar 2014」の12月20日の記事です。 先月報告したFirefox OSのHTMLインジェクションバグ(Bug 1101158 )について紹介します。このバグはFirefox OS Simulatorを含む一部の環境ではまだ修正されていませんが、リスク評価の上、Mozillaよりちょうど本日(！！)、公開の許可を頂き掲載しております。 HTML Injection on Firefox OS (Bug 1101158) Firefox OS v2.1/v2.2には、端末のホームボタンを長押ししたときに表示されるカードビューに、HTMLインジェクションの可能な箇所がありま
Taming the Asynchronous Beast with CSP Channels in JavaScript
Taming the Asynchronous Beast with CSP Channels in JavaScript This is an entry in a series about rebuilding my custom blog with react, CSP, and other modern tech. Read more in the blog rebuild series. Every piece of software deals with complex control flow mechanisms like callbacks, promises, events, and streams. Some require simple asynchronous coordination, others processing of event or stream-b
Making Sense of CSP Reports @ Scale
Ivan L., Engineering Manager - Security Sep 8, 2014 CSP is Awesome Content Security Policy isn’t new, but it is so powerful that it still feels like the new hotness. The ability to add a header to HTTP responses that tightens user-agent security rules and reports on violations is really powerful. Don’t want to load scripts from third party domain? Set a CSP and don’t. Trouble with mixed content w
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
