[abdilahrf]

[video=youtube]www.youtube.com/watch?v=fYjO5pIY1mY[/video]

"Frontend Security - Frontend Conference, Zürich 2013"

cuma ane masih binggung gmn cara kerja CSP
siapa yang sebelumnya sudah tau dengan CSP ?
kalau ada yang pernah tau boleh kita diskusikan tentang CSP di sini
kalau di liat di w3.org

usagenya seperti ini :

4.10.1 Usage

This section is non-normative.

The script-src directive lets developers specify exactly which script elements on a page were intentionally included for execution. Ideally, developers would avoid inline script entirely and whitelist scripts by URL. However, in some cases, removing inline scripts can be difficult or impossible. For those cases, developers can whitelist scripts using a randomly generated nonce.

Usage is straightforward. For each request, the server generates a unique value at random, and includes it in the Content-Security-Policy header:

Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com 'nonce-$RANDOM'
This same value is then applied as a nonce attribute to each script element that ought to be executed. For example, if the server generated the random value Nc3n83cnSAd3wc3Sasdfn939hc3, the server would send the following policy:

Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com 'nonce-Nc3n83cnSAd3wc3Sasdfn939hc3'
Script elements can then execute either because their src URLs are whitelisted or because they have an appropriate nonce:

<script>
alert("Blocked because the policy doesn't have 'unsafe-inline'.")
</script>

<script nonce="EDNnf03nceIOfn39fn3e9h3sdfa">
alert("Still blocked because nonce is wrong.")
</script>

<script nonce="Nc3n83cnSAd3wc3Sasdfn939hc3">
alert("Allowed because nonce is valid.")
</script>

<script src="https://example.com/allowed-because-of-src.js"></script>

<script nonce="EDNnf03nceIOfn39fn3e9h3sdfa"
src="https://elsewhere.com/blocked-because-nonce-is-wrong.js"></script>

<script nonce="Nc3n83cnSAd3wc3Sasdfn939hc3"
src="https://elsewhere.com/allowed-because-nonce-is-valid.js"></script>
Note that the nonce's value is not a hash or signature that verifies the contents of the script resources. It's quite simply a random string that informs the user agent which scripts were intentionally included in the page.

Script elements with the proper nonce execute, regardless of whether they're inline or external. Script elements without the proper nonce don't execute unless their URLs are whitelisted. Even if an attacker is able to inject markup into the protected resource, the attack will be blocked by the attacker's inability to guess the random value.

ane dapet refensi dari sini :
http://www.w3.org/TR/CSP11/
http://www.dotnetnoob.com/2012/09/securi...aders.html
http://www.virtuesecurity.com/blog/csp-m...l-hacking/

ssl free nya bisa pake : startssl
js eval : jsfuck.com =)) =))

[abdilahrf]

sundduull sundduull sundduull