Automatic generation of Content Security Policy to mitigate cross site scripting
| Title | Automatic generation of Content Security Policy to mitigate cross site scripting |
| Publication Type | Conference Paper |
| Year of Publication | 2016 |
| Authors | Mhana, Samer Attallah, Din, Jamilah Binti, Atan, Rodziah Binti |
| Conference Name | 2016 2nd International Conference on Science in Information Technology (ICSITech) |
| Date Published | oct |
| Keywords | Algorithm design and analysis, automatic content security policy generation, client-side security layer, composability, Cross Layer Security, Cross Site Scripting, cross-site scripting mitigation, CSP, CSP mechanism, Databases, HTML, Human Behavior, information technology, Internet, Java, JavaScript, pubcrawl, Resiliency, security, security of data, security policies, Servers, static contents, Uniform resource locators, URL, Web application, Web attack detection, Web attack mitigation, Web server layer, XSS |
| Abstract | Content Security Policy (CSP) is powerful client-side security layer that helps in mitigating and detecting wide ranges of Web attacks including cross-site scripting (XSS). However, utilizing CSP by site administrators is a fallible process and may require significant changes in web application code. In this paper, we propose an approach to help site administers to overcome these limitations in order to utilize the full benefits of CSP mechanism which leads to more immune sites from XSS. The algorithm is implemented as a plugin. It does not interfere with the Web application original code. The plugin can be "installed" on any other web application with minimum efforts. The algorithm can be implemented as part of Web Server layer, not as part of the business logic layer. It can be extended to support generating CSP for contents that are modified by JavaScript after loading. Current approach inspects the static contents of URLs. |
| URL | https://ieeexplore.ieee.org/document/7852656/ |
| DOI | 10.1109/ICSITech.2016.7852656 |
| Citation Key | mhana_automatic_2016 |
- JavaScript
- XSS
- Web server layer
- Web attack mitigation
- Web attack detection
- Web application
- URL
- Uniform resource locators
- static contents
- Servers
- security policies
- security of data
- security
- Resiliency
- pubcrawl
- Algorithm design and analysis
- Java
- internet
- information technology
- Human behavior
- HTML
- Databases
- CSP mechanism
- CSP
- cross-site scripting mitigation
- Cross Site Scripting
- Cross Layer Security
- composability
- client-side security layer
- automatic content security policy generation