{"id":2186,"date":"2017-01-29T08:45:20","date_gmt":"2017-01-29T16:45:20","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2186"},"modified":"2017-02-06T07:15:27","modified_gmt":"2017-02-06T15:15:27","slug":"mozilla-security-bytes-episode-1-csp","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/","title":{"rendered":"Mozilla Security Bytes, ep. 1: Content Security Policy"},"content":{"rendered":"<p>Sharing the work we do around web and information security is an important role of Mozilla Security. We often get questions on specific security technologies, both from our engineers who work on Mozilla products and services, and from the community interested in using these technologies in their own environments.<\/p>\n<p>Today, we introduce a new podcast, called Mozilla Security Bytes, <a href=\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"alignright size-thumbnail wp-image-2188\" src=\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-160x160.jpg\" alt=\"mozilla_security_bytes\" width=\"160\" height=\"160\" srcset=\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-160x160.jpg 160w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-252x252.jpg 252w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-768x768.jpg 768w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-600x600.jpg 600w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-32x32.jpg 32w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-50x50.jpg 50w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-64x64.jpg 64w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-96x96.jpg 96w, https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-128x128.jpg 128w\" sizes=\"(max-width: 160px) 100vw, 160px\" \/><\/a>where we discuss these security technologies in details.<\/p>\n<p>In this first episode, we talk about Content Security Policy, or CSP, with <a href=\"https:\/\/mozillians.org\/en-US\/u\/ckerschbaumer\/\">Christoph Kerschbaumer<\/a>,<a href=\"https:\/\/mozillians.org\/en-US\/u\/freddyb\/\"> Frederik Braun<\/a> and <a href=\"https:\/\/mozillians.org\/en-US\/u\/dylan\/\">Dylan Hardison<\/a>. We cover both the history and future of CSP, and various issues we have learned while implementing it on our own sites and services.<\/p>\n<p>We hope you find the discussion interesting, and feel free to share your feedback with us at security-bytes@mozilla.com.<\/p>\n<p><a href=\"https:\/\/d1driw5hlgyml1.cloudfront.net\/episodes\/1\/Mozilla+Security+Bytes+-+Episode+1+-+Content+Security+Policy.mp3\">Download link<\/a>, <a href=\"https:\/\/d1driw5hlgyml1.cloudfront.net\/feed.xml\">Podcast subscription URL<\/a><\/p>\n<!--[if lt IE 9]><script>document.createElement('audio');<\/script><![endif]-->\n<audio class=\"wp-audio-shortcode\" id=\"audio-2186-1\" preload=\"none\" style=\"width: 100%;\" controls=\"controls\"><source type=\"audio\/mpeg\" src=\"https:\/\/d1driw5hlgyml1.cloudfront.net\/episodes\/1\/Mozilla+Security+Bytes+-+Episode+1+-+Content+Security+Policy.mp3?_=1\" \/><a href=\"https:\/\/d1driw5hlgyml1.cloudfront.net\/episodes\/1\/Mozilla+Security+Bytes+-+Episode+1+-+Content+Security+Policy.mp3\">https:\/\/d1driw5hlgyml1.cloudfront.net\/episodes\/1\/Mozilla+Security+Bytes+-+Episode+1+-+Content+Security+Policy.mp3<\/a><\/audio>\n<h4>\u00a0Links mentioned in the episode<\/h4>\n<ul>\n<li><a href=\"https:\/\/pokeinthe.io\/2016\/11\/14\/state-of-security-alexa-one-top-million-2016-11\/\">Analysis of the Alexa Top 1M sites (October 2016)<\/a><\/li>\n<li><a href=\"http:\/\/dl.acm.org\/citation.cfm?id=358210\">Reflections on Trusting Trust<\/a><\/li>\n<li><a href=\"https:\/\/frederik-braun.com\/xfo-clickjacking.pdf\">X-Frame-Options: All About Clickjacking?<\/a><\/li>\n<li><a href=\"https:\/\/csp-evaluator.withgoogle.com\/\">Google&#8217;s CSP Evaluator<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/cure53\/XSSChallengeWiki\/wiki\/H5SC-Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22\">H5SC Minichallenge 3: &#8220;Sh*t, it&#8217;s CSP!&#8221;<\/a><\/li>\n<li><a href=\"http:\/\/research.sidstamm.com\/papers\/csp_icissp_2016.pdf\">Injecting CSP for Fun and Security<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Sharing the work we do around web and information security is an important role of Mozilla Security. We often get questions on specific security technologies, both from our engineers who &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/\">Read more<\/a><\/p>\n","protected":false},"author":652,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[301283],"tags":[],"coauthors":[45548],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Mozilla Security Bytes, ep. 1: Content Security Policy - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Julien Vehent\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/\",\"name\":\"Mozilla Security Bytes, ep. 1: Content Security Policy - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-160x160.jpg\",\"datePublished\":\"2017-01-29T16:45:20+00:00\",\"dateModified\":\"2017-02-06T15:15:27+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/859cacdfdbcc8ac96f58f1adc940e8dc\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes.jpg\",\"width\":3000,\"height\":3000},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mozilla Security Bytes, ep. 1: Content Security Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/859cacdfdbcc8ac96f58f1adc940e8dc\",\"name\":\"Julien Vehent\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/b873504437975149cff1eb424ae01d15\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b9b9662b5c966927b5cbff7f42bf323e?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b9b9662b5c966927b5cbff7f42bf323e?s=96&d=identicon&r=g\",\"caption\":\"Julien Vehent\"},\"description\":\"Julien runs the Firefox Operations Security team.\",\"sameAs\":[\"https:\/\/mozillians.org\/en-US\/u\/jvehent\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mozilla Security Bytes, ep. 1: Content Security Policy - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/","twitter_misc":{"Written by":"Julien Vehent","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/","url":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/","name":"Mozilla Security Bytes, ep. 1: Content Security Policy - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes-160x160.jpg","datePublished":"2017-01-29T16:45:20+00:00","dateModified":"2017-02-06T15:15:27+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/859cacdfdbcc8ac96f58f1adc940e8dc"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#primaryimage","url":"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes.jpg","contentUrl":"https:\/\/blog.mozilla.org\/security\/files\/2017\/01\/mozilla_security_bytes.jpg","width":3000,"height":3000},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2017\/01\/29\/mozilla-security-bytes-episode-1-csp\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Mozilla Security Bytes, ep. 1: Content Security Policy"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/859cacdfdbcc8ac96f58f1adc940e8dc","name":"Julien Vehent","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/b873504437975149cff1eb424ae01d15","url":"https:\/\/secure.gravatar.com\/avatar\/b9b9662b5c966927b5cbff7f42bf323e?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b9b9662b5c966927b5cbff7f42bf323e?s=96&d=identicon&r=g","caption":"Julien Vehent"},"description":"Julien runs the Firefox Operations Security team.","sameAs":["https:\/\/mozillians.org\/en-US\/u\/jvehent\/"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2186"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/652"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2186"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2186\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2186"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}