News for hackers. Stuff that matters.

A comment on Neatly Bypassing Content Security Policy.

Re:Neatly Bypassing Content Security Policy by dnag on Thursday July 12, 2018 @02:07AM (#17512511)
Just adding the sandbox attribute is enough to severely lock down an iframe.

<iframe sandbox src="http://example.com"></iframe>

[ Parent | on HN ]
Re:Neatly Bypassing Content Security Policy by mattbierner on Thursday July 12, 2018 @02:43AM (#17512665)
Just to add some context: 'sandbox' will make the iframe load in a unique origin and also disable scripts (along with disabling bunch of other things). This will prevent these attacks.

There's also ' frame-src' for content security policies, which lets you control what is allowed in the iframe's src. Even with these guards in place, you generally should not let user content drive an iframe's src

[ Parent | on HN ]
Re:Neatly Bypassing Content Security Policy by ChrisSD on Thursday July 12, 2018 @06:13AM (#17513315)
You'll also want the CSP `sandbox` policy on the `src` page to guard against direct linking.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

[ Parent | on HN ]