0

Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline script hashes and the inability to allow unsafe-inline and unsafe-eval per third-party domain. Also, managing the CSP would involve a developer with access to code and cannot be offloaded easily to non-developers (however, wrong this approach may seem, it seems to be what most companies prefer).

  • 2
    Aren't you basically asking for a solution which magically and effortless turns arbitrary kinds of rotten code into secure one? There is none. And if there would be one than why would anybody go the hard way? – Steffen Ullrich Sep 23 at 16:14
  • Well, I'm asking if there is a practical solution that is easy to manage. No company can financially justify blocking all third-party and marketing content in the name of CSP. There are some Tag Management Solutions (TMS) in the market that provide bits and pieces of control over the third-parties but these are not always effective due to being blocked by script blockers themselves. Report-uri is good but it still needs a developer to manage the CSP and make sense of the reports. – Display name Sep 23 at 16:31
  • No. In an attempt to be more helpful though, I suspect you are falling victim to the X-Y problem, so if you post a new question detailing the issue you are trying to fix, you may have better luck. – Conor Mancone Sep 23 at 18:26
3

The CSP attribute strict-dynamic was introduced to solve the problem of CSP becoming essentially unmanageable.

What does strict-dynamic do?

The idea of strict-dynamic is the following: Generate one piece of JavaScript that you trust, and use this scrip to load all other scripts. I like giving it a fancy name such as OneScriptToLoadThemAll.js, but for the purpose of brevity, I'll refer to it as the "root script", as you can imagine the trust propagated by these scripts like a tree.

What does the root script do?

The root script's goal is to load every subsequently used script. This script can also be used to add event listeners (e.g. onclick, etc.) to objects, and these would be trusted as well?

What can I do if I really hate CSP?

You can choose not to use it. It's not considered best practice though. If your code relies heavily on adding inline code originating from countless places, then you should refactor your code instead.

  • Will strict-dynamic approach work if you load third-party resources using it and what about other third-parties that get pulled by the third-party we reference? – Display name Oct 17 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.