{"id":4,"date":"2012-09-18T00:05:11","date_gmt":"2012-09-18T00:05:11","guid":{"rendered":"http:\/\/blog.mozilla.org\/tanvi\/?p=4"},"modified":"2022-07-14T21:00:22","modified_gmt":"2022-07-14T21:00:22","slug":"user-specified-content-security-policy","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/","title":{"rendered":"User Specified Content Security Policy"},"content":{"rendered":"

\"CSP<\/a>This summer I worked on a Google Summer of Code Project called User Specified Content Security Policy with Kailas Patil<\/a> (CS PhD student at the National University of Singapore). We created a Firefox add-on called UserCSP<\/a> that allows users and developers to apply custom Content Security Policies to websites.<\/p>\n

A Content Security Policy<\/a> is a declarative policy that restricts what content can load on a page.\u00a0 Its primary purpose is to mitigate Cross-Site Scripting<\/a> vulnerabilities.\u00a0 The core issue exploited by Cross-Site Scripting (XSS) attacks is the lack of knowledge in web browsers to distinguish between content that\u2019s intended to be part of web application, and content that\u2019s been maliciously injected into web application.<\/p>\n

To address this problem, CSP defines the Content-Security-Policy HTTP header that allows web application developers to create a whitelist of sources of trusted content, and instruct the client browsers to only execute or render resources from those sources.\u00a0 However, it is often difficult for developers to write a comprehensive Content Security Policy for their website.\u00a0 They may worry about breaking their page by blocking unanticipated but necessary content.\u00a0 They may not be able to easily change the CSP header for their site, which makes it challenging for them to experiment with policies until they find one that best protects their page without breaking site functionality.<\/p>\n

UserCSP changes this!<\/strong>\u00a0<\/em> A developer can now view the current policy applied to their site and create their own custom policy.\u00a0 They can choose to apply their custom policy on the site, or even combine their policy with the website’s existing policy.\u00a0 When combining policies, they have an option to choose from the strictest subset of the two, or the most lax subset.\u00a0 They can locally test their site with the custom policy applied and tweak the policy until they have one that works.<\/p>\n

The coolest feature of UserCSP is the Infer-CSP tab.\u00a0 This feature can help a developer derive a usable and secure policy for their site.\u00a0 By looking at the content the website loads, the add-on determines the strictest set of CSP rules it can apply to the site without breaking the current page.\u00a0 The inferred policy is provided in the proper syntax for the CSP Header, so all a developer needs to do is start serving this policy for their site via the CSP header.<\/p>\n

\"Screenshot<\/a><\/p>\n

 <\/p>\n

Security conscious users can also benefit from UserCSP.\u00a0 They can protect themselves by disabling content such as objects on personal finance sites or frames and third party javascript for their web-email.\u00a0 Here is an example, where you can see that a flash object used for an ad is blocked after the user applies a custom policy:<\/p>\n

\"\"<\/a>

finance.yahoo.com before any Content Security Policy is applied<\/p><\/div>\n

 <\/p>\n

\"\"<\/a>

User specifies CSP, setting object-src to none, so that plugins won’t load on the page<\/p><\/div>\n

 <\/p>\n

\"\"<\/a>

Once the user policy is applied, the plugins can’t load and the ads are no longer on the page<\/p><\/div>\n

We are looking to improve UserCSP, and are open to comments, suggestions, and reviews.\u00a0 I feel like we have only scratched the surface with this tool.\u00a0 We hope that after trying out the add-on, the security community will come up with ideas to further enhance it.\u00a0 The code is open source and can be found on Github.\u00a0 Check out the add-on and let us know what you think!<\/p>\n

UserCSP Add-on: <\/strong>https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/newusercspdesign\/<\/a>
\nUserCSP Code (Open Source):<\/strong> https:\/\/github.com\/patilkr\/userCSP<\/a>
\nUserCSP Documentation:<\/strong> https:\/\/wiki.mozilla.org\/SummerOfCode\/2012\/UserCSP\/Wiki<\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

This summer I worked on a Google Summer of Code Project called User Specified Content Security Policy with Kailas Patil (CS PhD student at the National University of Singapore). We created a Firefox add-on called UserCSP that allows users and developers to apply custom Content Security Policies to websites. A Content Security Policy is a… Read more<\/a><\/p>\n","protected":false},"author":412,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[69],"tags":[],"yoast_head":"\nUser Specified Content Security Policy - Tanvi Vyas<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"User Specified Content Security Policy - Tanvi Vyas\" \/>\n<meta property=\"og:description\" content=\"This summer I worked on a Google Summer of Code Project called User Specified Content Security Policy with Kailas Patil (CS PhD student at the National University of Singapore). We created a Firefox add-on called UserCSP that allows users and developers to apply custom Content Security Policies to websites. A Content Security Policy is a… Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Tanvi Vyas\" \/>\n<meta property=\"article:published_time\" content=\"2012-09-18T00:05:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-07-14T21:00:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo-285x300.jpg\" \/>\n<meta name=\"author\" content=\"Tanvi Vyas\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@TanviHacks\" \/>\n<meta name=\"twitter:site\" content=\"@TanviHacks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tanvi Vyas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/\",\"url\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/\",\"name\":\"User Specified Content Security Policy - Tanvi Vyas\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo-285x300.jpg\",\"datePublished\":\"2012-09-18T00:05:11+00:00\",\"dateModified\":\"2022-07-14T21:00:22+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/94b89a1b3d28fe214eb7543734810143\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo.jpg\",\"width\":\"509\",\"height\":\"534\",\"caption\":\"CSP Shield Logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/tanvi\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"User Specified Content Security Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/tanvi\/\",\"name\":\"Tanvi Vyas\",\"description\":\"Security and Privacy Engineer - @TanviHacks\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/tanvi\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/94b89a1b3d28fe214eb7543734810143\",\"name\":\"Tanvi Vyas\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9f4d447f27c116342ba41a747802372d?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9f4d447f27c116342ba41a747802372d?s=96&d=blank&r=g\",\"caption\":\"Tanvi Vyas\"},\"description\":\"Security\/Privacy Engineer and Tech Lead at Mozilla - @TanviHacks\",\"sameAs\":[\"https:\/\/blog.mozilla.org\/tanvi\/\",\"https:\/\/x.com\/@TanviHacks\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"User Specified Content Security Policy - Tanvi Vyas","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/","og_locale":"en_US","og_type":"article","og_title":"User Specified Content Security Policy - Tanvi Vyas","og_description":"This summer I worked on a Google Summer of Code Project called User Specified Content Security Policy with Kailas Patil (CS PhD student at the National University of Singapore). We created a Firefox add-on called UserCSP that allows users and developers to apply custom Content Security Policies to websites. A Content Security Policy is a… Read more","og_url":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/","og_site_name":"Tanvi Vyas","article_published_time":"2012-09-18T00:05:11+00:00","article_modified_time":"2022-07-14T21:00:22+00:00","og_image":[{"url":"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo-285x300.jpg"}],"author":"Tanvi Vyas","twitter_card":"summary_large_image","twitter_creator":"@TanviHacks","twitter_site":"@TanviHacks","twitter_misc":{"Written by":"Tanvi Vyas","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/","url":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/","name":"User Specified Content Security Policy - Tanvi Vyas","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/tanvi\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo-285x300.jpg","datePublished":"2012-09-18T00:05:11+00:00","dateModified":"2022-07-14T21:00:22+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/94b89a1b3d28fe214eb7543734810143"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#primaryimage","url":"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo.jpg","contentUrl":"https:\/\/blog.mozilla.org\/tanvi\/files\/2012\/09\/CSP_Shield_Logo.jpg","width":"509","height":"534","caption":"CSP Shield Logo"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/tanvi\/2012\/09\/18\/user-specified-content-security-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/tanvi\/"},{"@type":"ListItem","position":2,"name":"User Specified Content Security Policy"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/tanvi\/#website","url":"https:\/\/blog.mozilla.org\/tanvi\/","name":"Tanvi Vyas","description":"Security and Privacy Engineer - @TanviHacks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/tanvi\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/94b89a1b3d28fe214eb7543734810143","name":"Tanvi Vyas","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/tanvi\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/9f4d447f27c116342ba41a747802372d?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f4d447f27c116342ba41a747802372d?s=96&d=blank&r=g","caption":"Tanvi Vyas"},"description":"Security\/Privacy Engineer and Tech Lead at Mozilla - @TanviHacks","sameAs":["https:\/\/blog.mozilla.org\/tanvi\/","https:\/\/x.com\/@TanviHacks"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/posts\/4"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/users\/412"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/comments?post=4"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/posts\/4\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/media?parent=4"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/categories?post=4"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/tanvi\/wp-json\/wp\/v2\/tags?post=4"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}