-
Notifications
You must be signed in to change notification settings - Fork 39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security] Nonce reuse #82
Comments
It would be great if an nonce could be passed to the page at runtime somehow. |
I came across this option but I'm not sure the CSP HTML Webpack Plugin makes use of it? https://webpack.js.org/guides/csp/ I've tried setting |
You're correct in your assumption - nonces are only useful if they are changing often, ideally on every page load. If your app will be deployed for long periods of time without its source code changing, you should either:
At Slack, we have opted to only use shas |
@AnujRNair thanks for your reply! Are there any potential risks that We tried getting |
Not to my knowledge. As far as I am aware, they're as good as each other. Someone can correct me if you find otherwise!
|
Thanks for confirming @AnujRNair! I really like this module, but I think the way (esp. the defaults) are implemented right now could cause many applications to end up with a trivially bypassable CSP. I think it's crucial to provide a secure-by-default configuration as most users won't know all the intricate details about CSP:
Regarding @slapbox's question on nonces vs. hashes:
|
Great writeup @lweichselbaum.
I think this part is a bit tough though. Any secure CSP will break most projects and will only be fixable by users who understand CSP in the first place. Providing a secure example isn't enough and so I feel like directing people to external resources might be best here. |
Thank you!
I think it's possible to have a secure CSP without breaking most projects. |
@AnujRNair I found that hashes aren't applied except to inlined scripts and styles - so I'm wondering if you have any advice for getting |
@AnujRNair how are you going about using SHAs at Slack? It seems like this is the route we'll have to go, but it's not really supported yet in the plugin. Any advice for how to move forward? It seems like we've just hit an unbreakable wall here. |
Sorry for the delay in getting back to you here @lweichselbaum thanks so much for the detailed writeup and presentation - it was extremely useful. @slapbox that is correct - only inline styles and scripts are hashed at the moment. #87 is exploring whether we can hash external script and style tags as well At Slack, we only use hashes, and we generate our script tags as @lweichselbaum recommended. We do this by defining a custom template, and passing it to the HtmlWebpackPlugin instance. You can do the same with something similar: webpack config:
template.ejs:
This is the basics, but there's lots more customization you can do there |
Maybe there could be a way to have the nonce injection be a replaceable token, so that the nonce token could be replaced dynamically at runtime? I would like that ability, because I am attempting to do just that, until a hash can be generated for an external script/stylesheet. I've got this working currently, by overriding the |
Nonce reuse
I have a question in regard to
nonceEnabled
:I assume that the
csp-html-webpack-plugin
is only invoked at build time and not for every http request. If this assumption is correct, how can one prevent attackers from just copying CSP nonces and by that bypassing the entire CSP?Relevant section in the CSP spec is here: https://w3c.github.io/webappsec-csp/#security-nonces
What type of issue is this? (place an
x
in one of the[ ]
)Requirements (place an
x
in each of the[ ]
)The text was updated successfully, but these errors were encountered: