Brandon Sterne » Web Security http://brandon.sternefamily.net/posts The Whole Brevity Thing Mon, 14 Mar 2011 22:52:08 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 WordPress CSP Plugin http://brandon.sternefamily.net/posts/2010/05/wordpress-csp-plugin/ http://brandon.sternefamily.net/posts/2010/05/wordpress-csp-plugin/#comments Fri, 28 May 2010 18:41:30 +0000 bsterne http://brandon.sternefamily.net/posts/?p=350 My implementation of the Content Security Policy server logic for WordPress is now available as a WordPress Plugin.

Fig.1 – CSP configuration page making a policy recommendation.

Fig. 2 – New panel in media uploader allows direct creation of script files in the uploads directory.

]]> http://brandon.sternefamily.net/posts/2010/05/wordpress-csp-plugin/feed/ 1 WordPress and Content Security Policy http://brandon.sternefamily.net/posts/2010/04/wordpress-and-content-security-policy/ http://brandon.sternefamily.net/posts/2010/04/wordpress-and-content-security-policy/#comments Tue, 13 Apr 2010 03:54:15 +0000 bsterne http://brandon.sternefamily.net/posts/?p=198 Content Security Policy in WordPress. Today, I posted my first patch to WordPress, still a work in progress, which adds an administration panel for configuring CSP. One of the features I'm rather happy with is "Suggest Policy", which analyzes the content in the user's blog and recommends a policy based on the content types and sources it finds.

]]> Lately, I have been implementing the server logic for Content Security Policy in WordPress. I was very pleased to see that the WordPress community opened up the tracking bug for this feature around the time we first blogged about it. One of the neat things about working for Mozilla is that contributions to other important open source projects are treated as valid, valuable uses of our time.

Today, I posted my first patch to WordPress, still a work in progress, which adds an administration panel (see below) for configuring CSP. One of the features I’m rather happy with is “Suggest Policy”, which analyzes the content in the user’s blog and recommends a policy based on the content types and sources it finds.

Next I’ll be working on moving the remaining inline script into external script files. Stay tuned for further updates!

]]> http://brandon.sternefamily.net/posts/2010/04/wordpress-and-content-security-policy/feed/ 0 Content Security Policy – Preview Builds http://brandon.sternefamily.net/posts/2009/10/content-security-policy-preview-builds/ http://brandon.sternefamily.net/posts/2009/10/content-security-policy-preview-builds/#comments Thu, 01 Oct 2009 16:55:02 +0000 bsterne http://brandon.sternefamily.net/posts/?p=124 Content Security Policy is available for testing! We've been working hard on implementing the CSP spec and now the new features are ready to be put to the test. I would like to encourage any interested parties, whether web security researchers or website administrators, to grab a preview build of Firefox with CSP enabled and head over to the demo page to see it in action.]]> I posted this over at the Mozilla Security Blog but wanted to share it here as well. I am excited to report that Content Security Policy is available for testing! We’ve been working hard on implementing the CSP spec and now the new features are ready to be put to the test.

I would like to encourage any interested parties, whether web security researchers or website administrators, to head over to Mozilla Try Server and grab a preview build of Firefox with CSP enabled:

Windows: 1256079015-win32.zip
Mac OS X: 1256079015-macosx.dmg
Linux: 1256079015-linux.tar.bz2

Once you have it, you can test the core functionality of CSP at the demo page I set up on my Mozilla web space. There is a lot more information about this project there and I look forward to any feedback you have to share with me.

]]> http://brandon.sternefamily.net/posts/2009/10/content-security-policy-preview-builds/feed/ 0 Content Security Policy – Update http://brandon.sternefamily.net/posts/2009/04/content-security-policy-update/ http://brandon.sternefamily.net/posts/2009/04/content-security-policy-update/#comments Tue, 07 Apr 2009 16:00:01 +0000 bsterne http://brandon.sternefamily.net/posts/?p=118 I published another set of changes to the Content Security Policy proposal. We are getting very close to the implementation phase now, and I’ve made a final call for feedback. Sid and I are in the process of moving the documentation to the Mozilla Wiki, where the final specification will live.

]]> http://brandon.sternefamily.net/posts/2009/04/content-security-policy-update/feed/ 0 Content Security Policy (was Site Security Policy) http://brandon.sternefamily.net/posts/2008/09/content-security-policy/ http://brandon.sternefamily.net/posts/2008/09/content-security-policy/#comments Fri, 05 Sep 2008 15:51:49 +0000 bsterne http://brandon.sternefamily.net/posts/?p=111 I updated my web security proposal with a fairly large set of changes. I removed Cross Site Request Forgery from the scope of the proposal and instead will focus on the implementation of the Origin header. The syntax has also been expanded to allow policy creation for a larger set of content types, e.g. not just JavaScript.

]]> http://brandon.sternefamily.net/posts/2008/09/content-security-policy/feed/ 0 Site Security Policy http://brandon.sternefamily.net/posts/2008/06/site-security-policy/ http://brandon.sternefamily.net/posts/2008/06/site-security-policy/#comments Wed, 04 Jun 2008 15:46:14 +0000 bsterne http://brandon.sternefamily.net/posts/?p=108 I published a proposal for a set of browser security features that I hope to get turned into an open web standard and implemented in a future version of Firefox. The goal is create a mechanism that allows websites to communicate security policies to the browser which dictate how web content should behave.

]]> http://brandon.sternefamily.net/posts/2008/06/site-security-policy/feed/ 0