0

Some of my workmates are developing a video player using Javascript. AFAIK, we are not going to have any website. The clients will connect to the server, download the javascript code and then render the player in their site.

In this context, does it make sense to use CSP in our code? Is it even possible? All the examples I see are focused in how to use CSP for protecting a website against XSS.

1

CSP applies to the page containing the code, not the code. In your case, this means that the client pages may or may not have content security policies which allow (or don't allow) your script to run based on it being a third party script.

Your script can't influence those - that's kind of the point. CSP is designed to ensure that only known scripts run, or known elements are able to be loaded by the page.

In the case of a video player script, the hosting site (the one which loads your code) would need to allow your script, and for the appropriate types of files to be loaded from your servers if they implemented CSP. You may need to look at CORS to enable access to content from your domain by your script, which is running in the context of the client site, although this depends on what you're doing with it - if you're just including a video file using a <video> tag, this probably isn't needed.

2
  • so from our side, we can't do anything about security, can we? And yes, afaik, the video is going into a <video> tag – Ay0 Feb 19 '16 at 12:13
  • You can ensure that your script doesn't open any unintended XSS vulnerabilities, make sure that your hosting is unlikely to be compromised (if you get compromised, so does anyone including your script), provide viable CSP data for script users to implement (or even a self-hosted version). You can't implement CSP - that doesn't mean you can't look at other elements of security. – Matthew Feb 19 '16 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.