Last updated: Sep 22nd, 2014 at 12:21PM PDT. I added some info about using CSP with AngularJS.
Last Thursday, I published a blog post in which I summarized the main attack techniques (XSS, CSRF, and MITM) used by baddies to screw with the web. That post also covered two header-based solutions available to help you defend your site: CSP and HSTS. To supplement all that info, I am providing a bunch of articles, references, videos, and tools to help you learn more and take advantage of CSP and HSTS.
Content Security Policy (CSP)
Browser Support
Cross-browser support for CSP is pretty good. The latest versions of IE require the CSP header to use a special prefix (much like vendor prefixes for certain CSS features). Older crap like IE9 and below have no CSP support.
AngularJS + CSP
Sadly, CSP reduces Angular’s performance because the framework does some optimizations that run afowl of CSP. I imagine that the performance loss shouldn’t be a problem unless you have a ton of Angular expressions on the page at once (e.g., you use ng-repeat to generate hundreds of expressions).
Despite these concerns, CSP is highly recommended by the AngularJS FAQ page. For more info on how to use CSP with AngularJS, check out the docs for the ngCSP directive.
Further Reading/References
Awesome Presentation on CSP
HTTP Strict Transport Security (HSTS)
Browser Support
Most browsers get a passing grade when it comes to HSTS support –except for…
Internet Explorer doesn’t support HSTS—which means that there’s basically no such thing as a secure website in IE
Further Reading/References
- MDN - HSTS Overview
- EFF - HSTS is a must
- Leviathan - Caveat for using HSTS with wildcard SSL certificates
Quick Video Summary of MITM and HSTS
Note: The video above provides outdated browser support info. Updated info can be found here: CanIUse.com.
Bonus: Security Toolkit for Express Apps
Lusca
Do you use Node.js? Does your Node.js app use Express? Want some middleware to help secure that app? Perhaps you should consider using Lusca, a free module created by Paypal to quickly add and configure various security features such as CSP and HSTS. I haven’t personally tried it yet, but I plan to do so soon. Their README file makes Lusca look very easy for devs to use.
You can pick and choose which security features you want to enable. For example, if you’re already using JSON Web Tokens, then you may not want to use Lusca’s CSRF method while you take advantage of Lusca’s legacy browser XSS protection.
By the way, don’t get confused: Paypal uses their own open-source, Express-based framework called KrakenJS, but Lusca works with Kraken apps and Express apps.