Web Application Defender's Cookbook

Recipe 10-1: Implementing Content Security Policy (CSP)

This recipe shows you how to use ModSecurity to set a CSP for clients and monitor for policy violation reports.

Ingredients

• OWASP AppSensor1
  • Suspicious Client-side Behavior
• OWASP ModSecurity Core Rule Set (CRS)
  • modsecurity_crs_10_setup.conf
  • modsecurity_crs_42_csp_enforcement.conf
• Apache
  • mod_headers header
• ModSecurity
  • REQUEST_HEADERS variable
  • REQUEST_BODY variable
  • @validateByteRange operator
  • setvar action
  • setenv action

Content Security Policy (CSP)

Mozilla has developed a fantastic security capability in the Firefox web browser called Content Security Policy (CSP), which it describes as follows:

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.

CSP is designed to be fully backward compatible; browsers that don’t support it still work with servers that implement it, and vice versa. Browsers that don’t support CSP simply ignore it, functioning as usual, defaulting to the standard same-origin policy for web content. If the site doesn’t offer the CSP header, browsers likewise use the standard same-origin policy.

Enabling CSP is as easy as configuring your web server to return the X-Content-Security-Policy HTTP header. See Using Content Security Policy for details on how to configure ...