70

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input.

I encourage users to use NoScript, however many times users do not listen. Putting a big message across the page forcing them to disable scripts is too annoying to be useful, and users ignore warnings.

Is there a way I could make my site tell the user's browser that my page has no scripts, and if it finds any on the page then to ignore them?

I am doing this as an extra precaution against XSS which could be from malicious hackers, or from investigators attempting to identify IPs of users on my site.

EDIT: Just to make it clear I want the website to tell the browser to do this, I don't want to have to tell each visitor how to configure their browser. Users are dumb and lazy usually.

  • 27
    Not really an answer, but you could add nag messages (or even disable the page) using... wait for it... scripts! So if they have ignored your advice to disable scripts, they will be nagged/disabled. But if they have disabled scripts as you have requested, they will see nothing but your site/service. – loneboat Jun 3 '16 at 14:35
  • 2
    @loneboat, "... is too annoying to be useful." – user1717828 Jun 3 '16 at 15:43
  • 9
    Is this 2016? "everything" needs JS; XSS is simply bad programming and can be avoided by a mile... – Kyslik Jun 4 '16 at 14:00
  • 3
    @Kyslik - Tor hidden service providers recommend disabling javascript mostly due to stuff like this. As far as I'm aware, javascript is just as likely to be insecure today in 2016 as it was in 2013. – Jules Jun 5 '16 at 7:52
  • 1
    @loneboat But in case of a successful XSS attack the malicious script could disable the message. So the site would nag at users when everything is ok and won't when they are at risk. – kapex Jun 6 '16 at 9:04
136

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers.

Consider the following header:

Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self';

This tells the browser to disable scripts, frames, connections and any other objects/media. We then permit images and stylesheets to be loaded, but only from the same domain.

  • 10
    Of course, if there is some man in the middle or browser plugin which wants to inject script it can simply delete the CSP header since the header is per response and not per site. – Steffen Ullrich Jun 3 '16 at 12:24
  • 81
    @SteffenUllrich if the attacker has enough control to modify the headers, I feel like they're already beyond XSS. – grc Jun 3 '16 at 12:39
  • 5
    @PatrickM you can set font-src as needed. – grc Jun 3 '16 at 15:13
  • 4
    @grc Ya. I wasn't disagreeing with your answer. I more meant it as a warning to the original poster that he might need to allow fonts too. – Patrick M Jun 3 '16 at 15:15
  • 6
    Virtually all techniques for mitigating XSS, XSRF, etc assume the attacker cannot modify the page sent from server to user, because virtually all such mitigations would fail in that case. When talking about man-in-the-middle attacks, XSS, XSRF etc do not factor into that conversation - and as you rightly point out, at that point things like HSTS become relevant instead. It doesn't mean you don't try to mitigate XSS and XSRF as well, but that exists on a different layer of attacker access where there is not yet any possibility for man-in-the-middle. – thomasrutter Jun 6 '16 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.