8

I think it would be a good idea to enable Content Security Policy on Stack Exchange. With CSP it's possible to disable inline scripts, and that can improve security. For example, some time ago I found an XSS vulnerability in the Stack Exchange chat. I reported it and it was fixed, but that vulnerability wouldn't even be possible if inline scripts were disabled with CSP.

Improve this question
6
  • Given the number of inline scripts on this page, they certainly won't be able to just "enable" it.
    – Alexander O'Mara
    Commented Nov 22, 2016 at 22:17
  • @AlexanderO'Mara Yeah, that'll require some more work than just adding a CSP header, but I still think it's worth it.
    – Michał Perłakowski
    Commented Nov 22, 2016 at 22:21
  • Agreed, I personally would like to see CSP become the norm. I suspect in this case it will be a lot of work though.
    – Alexander O'Mara
    Commented Nov 22, 2016 at 22:24
  • 1
    There are a lot of things going on on the main sites to complicate this, but maybe it would be possible to start by blocking your fun by implementing CSP in chat. ;)
    – Jeremy StaffMod
    Commented Nov 22, 2016 at 23:08
  • CSP retrofitting is a nightmare for big sites. You can take the mellow view like Facebook, and just lock it down to the domains you take images, styles and scripts from, which makes it impossible for attackers to use off the shelf tools like BeEF for exploitation. But doesn't really exploit the power of CSP to stop XSS.
    – Simon
    Commented Jun 22, 2017 at 11:10
  • Looks like SE has a CSP now but it needs to be extended to include frame-ancestors: self, it also appears various browsers may no longer be respecting x-frame-options
    – Mgetz
    Commented Jun 28, 2018 at 16:28

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .