2

I have been messing about with website design for years, but I am no expert - more of a hardware junkie.

CSP is fascinating for me now that I am starting to branch out into web development. I was really battling with hashes for my scripts because I used an online SHA-384 generator & Chrome wouldn't recognise those. Eventually I twigged that Chrome actually supplied 256-bit hashes for me, and I could include those in my .htaccess file - it was just a question of iterating over the pages on my site, grabbing the hashes, and including them in my list of approved scripts & styles.

As I said, I am no coding master, so I have encountered a problem where Chrome doesn't give me the actual hash for a script, trunctating it to sha256..., and I have no clue what script is running (Wordpress). Before you all shout me down, I have built sites without using a CMS, but this is the platform I am working on at the moment.

How do I find the code for the injected script so I can hash it & include it? From Mozilla's docs, I found that a hash should include all white space excluding the "script" tag - I tried that & got nowhere with my FB Pixel code, so I deleted that, perhaps you have an answer for me on that one?

As for the inline injected script - I need to find out how to identify what is being injected, and how to hash it for my CSP.

  • 1
    Hi and welcome to the site! I took the liberty to remove the last paragraph, since it was not really related to your question. Offering off site rewards is not encouraged here. Instead upvote good answers, and if an answer solves your problem, accept it. – Anders Apr 19 '18 at 19:33
1

For a CMS, such as wordpress, I would strongly recommend using a nonce instead of hashes. There is even a plugin for that.

Including too many hashes has performance cost, as the browser has to hash all the scripts to compare the hashes. Also using it on files that change, for example because of updates is not feasible.

If you still want to use it, my only advice can be to look for a way to get the error "untruncted". You can try to shorten the header so that there is more space in the console or try to look into Chrome log files, whether it is there.

  • I tried 'verbose' in Chrome console & still got the 'sha...' message. I don't have that many scripts running, because I have done all the social-sharing goodness in PHP - dynamically generated with a little bit of help from advancedcustomfields.com to add extra fields for og:description & og:image. I am using foundationpress.olefredrik.com as the basis of my Wordpress installation, so the code is pretty tight in terms of optimisation. – Flatspin Apr 19 '18 at 19:57
  • and then I need to learn to use these blinking linky things :P – Flatspin Apr 19 '18 at 19:58
  • Should I removed my CSP from my .htacess file, because that would be my understanding & how can I trust a WP-addon to offer server-level security? Can we just not find the inline scripts that are annoying me? – Flatspin Apr 19 '18 at 20:07
  • Well, it is not easy to find those pesky scripts. What is worse, the scripts may sometimes change, because PHP may be entering values in. Also, the header is not server level security!!! If the attacker can execute PHP code, it can easily override the headers anyway (unless you block the header() function and any related functions explicitly in your PHP config). – Peter Harmann Apr 19 '18 at 20:09
  • @Flatspin Also, you shoul leave them in the .htaccess. The plugin does not handle headers on resources, only PHP files, so you still need security headers for images, javascript, css and other resources. The plugin will replace the headers with a variant that allows the javascript with nonce. – Peter Harmann Apr 19 '18 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.