71

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input.

I encourage users to use NoScript, however many times users do not listen. Putting a big message across the page forcing them to disable scripts is too annoying to be useful, and users ignore warnings.

Is there a way I could make my site tell the user's browser that my page has no scripts, and if it finds any on the page then to ignore them?

I am doing this as an extra precaution against XSS which could be from malicious hackers, or from investigators attempting to identify IPs of users on my site.

EDIT: Just to make it clear I want the website to tell the browser to do this, I don't want to have to tell each visitor how to configure their browser. Users are dumb and lazy usually.

Improve this question
10
  • 27
    Not really an answer, but you could add nag messages (or even disable the page) using... wait for it... scripts! So if they have ignored your advice to disable scripts, they will be nagged/disabled. But if they have disabled scripts as you have requested, they will see nothing but your site/service.
    – loneboat
    Jun 3, 2016 at 14:35
  • 2
    @loneboat, "... is too annoying to be useful."
    – user1717828
    Jun 3, 2016 at 15:43
  • 9
    Is this 2016? "everything" needs JS; XSS is simply bad programming and can be avoided by a mile...
    – Kyslik
    Jun 4, 2016 at 14:00
  • 3
    @Kyslik - Tor hidden service providers recommend disabling javascript mostly due to stuff like this. As far as I'm aware, javascript is just as likely to be insecure today in 2016 as it was in 2013.
    – Jules
    Jun 5, 2016 at 7:52
  • 1
    @loneboat But in case of a successful XSS attack the malicious script could disable the message. So the site would nag at users when everything is ok and won't when they are at risk.
    – kapex
    Jun 6, 2016 at 9:04

1 Answer 1

Reset to default
136

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers.

Consider the following header:

Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self';

This tells the browser to disable scripts, frames, connections and any other objects/media. We then permit images and stylesheets to be loaded, but only from the same domain.

Improve this answer
9
  • 10
    Of course, if there is some man in the middle or browser plugin which wants to inject script it can simply delete the CSP header since the header is per response and not per site.
    – Steffen Ullrich
    Jun 3, 2016 at 12:24
  • 82
    @SteffenUllrich if the attacker has enough control to modify the headers, I feel like they're already beyond XSS.
    – grc
    Jun 3, 2016 at 12:39
  • 5
    @PatrickM you can set font-src as needed.
    – grc
    Jun 3, 2016 at 15:13
  • 4
    @grc Ya. I wasn't disagreeing with your answer. I more meant it as a warning to the original poster that he might need to allow fonts too.
    – Patrick M
    Jun 3, 2016 at 15:15
  • 6
    Virtually all techniques for mitigating XSS, XSRF, etc assume the attacker cannot modify the page sent from server to user, because virtually all such mitigations would fail in that case. When talking about man-in-the-middle attacks, XSS, XSRF etc do not factor into that conversation - and as you rightly point out, at that point things like HSTS become relevant instead. It doesn't mean you don't try to mitigate XSS and XSRF as well, but that exists on a different layer of attacker access where there is not yet any possibility for man-in-the-middle.
    – thomasrutter
    Jun 6, 2016 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .