0

Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline script hashes and the inability to allow unsafe-inline and unsafe-eval per third-party domain. Also, managing the CSP would involve a developer with access to code and cannot be offloaded easily to non-developers (however, wrong this approach may seem, it seems to be what most companies prefer).

Improve this question
3
  • 2
    Aren't you basically asking for a solution which magically and effortless turns arbitrary kinds of rotten code into secure one? There is none. And if there would be one than why would anybody go the hard way?
    – Steffen Ullrich
    Sep 23, 2019 at 16:14
  • Well, I'm asking if there is a practical solution that is easy to manage. No company can financially justify blocking all third-party and marketing content in the name of CSP. There are some Tag Management Solutions (TMS) in the market that provide bits and pieces of control over the third-parties but these are not always effective due to being blocked by script blockers themselves. Report-uri is good but it still needs a developer to manage the CSP and make sense of the reports.
    – Display name
    Sep 23, 2019 at 16:31
  • No. In an attempt to be more helpful though, I suspect you are falling victim to the X-Y problem, so if you post a new question detailing the issue you are trying to fix, you may have better luck.
    – Conor Mancone
    Sep 23, 2019 at 18:26

1 Answer 1

Reset to default
3

The CSP attribute strict-dynamic was introduced to solve the problem of CSP becoming essentially unmanageable.

What does strict-dynamic do?

The idea of strict-dynamic is the following: Generate one piece of JavaScript that you trust, and use this scrip to load all other scripts. I like giving it a fancy name such as OneScriptToLoadThemAll.js, but for the purpose of brevity, I'll refer to it as the "root script", as you can imagine the trust propagated by these scripts like a tree.

What does the root script do?

The root script's goal is to load every subsequently used script. This script can also be used to add event listeners (e.g. onclick, etc.) to objects, and these would be trusted as well?

What can I do if I really hate CSP?

You can choose not to use it. It's not considered best practice though. If your code relies heavily on adding inline code originating from countless places, then you should refactor your code instead.

Improve this answer
1
  • Will strict-dynamic approach work if you load third-party resources using it and what about other third-parties that get pulled by the third-party we reference?
    – Display name
    Oct 17, 2019 at 19:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .