CSP is one of the most elaborate security policies in modern browsers. Besides acting as a second line of defense against XSS, CSP offers control over various types of content, outgoing connections, and the application's behavior. In this article, we elaborate on these features and provide you with a prioritized CSP deployment guide that will help you configure CSP in production.

24 May 2022 Security Policies Browser Security, Content Security Policy (CSP), XSS

The recommended best practice for modern CSP policies relies on hashes, nonces, and 'strict-dynamic'. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing 'self', which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page.

11 April 2022 Security Policies Browser Security, Content Security Policy (CSP), XSS

Content Security Policy (CSP) started as a simple defense but quickly evolved into a complex security policy. This article investigates how to build an effective CSP policy to counter XSS vulnerabilities. Concretely, we use step-by-step examples to highlight bypasses against CSP and examine how to use nonces, hashes, and 'strict-dynamic' to build a robust CSP policy for modern applications.

13 December 2021 Security Policies Browser Security, Content Security Policy (CSP), XSS

XSS vulnerabilities remain a top threat to any HTML-based web application. In fact, 75% of web vulnerabilities in Google's reward program are XSS vulnerabilities! Fortunately, built-in platform defenses such as Content Security Policy and Trusted Types equip us with the tools to tackle XSS. In this article, we briefly look at modern XSS vulnerabilities, followed by a detailed look at using Trusted Types policies to mitigate such vulnerabilities. In the end, we provide you with a list of concrete developer guidelines to apply Trusted Types in your projects.

15 June 2021 Security Policies Browser Security, Content Security Policy (CSP), XSS, Trusted Types

In this article, we investigate the security properties of refresh tokens in the browser. We investigate why frontend web applications need refresh token rotation and what we gain by using refresh token rotation. Next, we dive into concrete attack scenarios that bypass refresh token rotation and discuss how sensitive SPAs should use a backend-for-frontend to secure tokens.

9 April 2021 OAuth 2.0 & OpenID Connect OAuth 2.0, XSS, Single Page Applications, Refresh tokens

A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article, we look at Angular's built-in XSS defenses, along with insecure coding patterns that inadvertently bypass these protections.

1 February 2021 SPA Security XSS, Angular, Single Page Applications

JSON.stringify() is perhaps one of the most mundane APIs in modern browsers. The functionality to translate a JavaScript object into a string-based representation is hardly thrilling. But when the stars align, a simple JSON serialization operation can result in a significant XSS vulnerability. This article tells the nail-biting story of such a vulnerability in Scully, an Angular-based static site generator.

26 January 2021 SPA Security XSS, Angular, Scully, Single Page Applications

Preventing XSS in React is manageable when you stay within the boundaries of the framework, but becomes hard once you step out of React's safe zone. In this article, we take a closer look at escape hatches and component parsers and all the reasons you should avoid them. Read on to discover the next level of XSS in React applications.

14 June 2020 SPA Security XSS, React, Single Page Applications

Dynamically rendering benign HTML code in React requires the use of dangerouslySetInnerHTML. That is not a naming mistake. This property is dangerous, and using it carelessly will create XSS vulnerabilities in your application. In this article, we discuss why the property is there, how you can use it, and how the Signal messenger misused it. This article is the second in a series of three, and a must-read for every React developer.

28 May 2020 SPA Security XSS, React, Single Page Applications

A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article series, we look at how React prevents XSS, but also how its shortcomings leave a lot in the hands of a developer. This article is the first in a series of three.

13 May 2020 SPA Security XSS, React, Single Page Applications

Single Page Applications can use refresh tokens in the browser. Yes, you read that right. This new development is awesome, because it makes access token renewal much more elegant. However, refresh tokens in the browser require additional security measures, such as refresh token rotation. We discuss the pros and cons of refresh token rotation, along with the potential dangers. In the end, you will find five strategies you can use to secure your tokens in your web frontends better.

30 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, Refresh tokens, XSS

Most developers are afraid of storing tokens in LocalStorage due to XSS attacks. While LocalStorage is easy to access, the problem actually runs a lot deeper. In this article, we investigate how an attacker can bypass even the most advanced mechanisms to obtain access tokens through an XSS attack. Concrete recommendations are provided at the end.

16 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, LocalStorage, XSS