5

I think it would be a good idea to enable Content Security Policy on Stack Exchange. With CSP it's possible to disable inline scripts, and that can improve security. For example, some time ago I found an XSS vulnerability in the Stack Exchange chat. I reported it and it was fixed, but that vulnerability wouldn't even be possible if inline scripts were disabled with CSP.

  • Given the number of inline scripts on this page, they certainly won't be able to just "enable" it. – Alexander O'Mara Nov 22 '16 at 22:17
  • @AlexanderO'Mara Yeah, that'll require some more work than just adding a CSP header, but I still think it's worth it. – Michał Perłakowski Nov 22 '16 at 22:21
  • Agreed, I personally would like to see CSP become the norm. I suspect in this case it will be a lot of work though. – Alexander O'Mara Nov 22 '16 at 22:24
  • 1
    There are a lot of things going on on the main sites to complicate this, but maybe it would be possible to start by blocking your fun by implementing CSP in chat. ;) – Jeremy Banks Nov 22 '16 at 23:08
  • CSP retrofitting is a nightmare for big sites. You can take the mellow view like Facebook, and just lock it down to the domains you take images, styles and scripts from, which makes it impossible for attackers to use off the shelf tools like BeEF for exploitation. But doesn't really exploit the power of CSP to stop XSS. – Simon Jun 22 '17 at 11:10
  • Looks like SE has a CSP now but it needs to be extended to include frame-ancestors: self, it also appears various browsers may no longer be respecting x-frame-options – Mgetz Jun 28 '18 at 16:28

You must log in to answer this question.

Browse other questions tagged .