Other nomination

GitHubs post-CSP journey

Patrick Toomey · The GitHub Blog · 19 January 2017

Once CSP stops script execution, attackers steal page secrets with dangling markup: an unclosed img src swallows the CSRF token, and permitted image hosts such as Google Analytics and Gravatar become exfiltration endpoints. GitHub answers with a stricter img-src, markup-closing prefixes before forms, per-form CSRF tokens and a SameSite session cookie.

Record

Researcher

Patrick Toomey

Published by

The GitHub Blog

Date

19 January 2017

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Related sources

• Earlier article
• Protection implementation

Tags

• csp
• csrf
• info-leak
• cookie
• injection
• mitigation
• defence
• github
• rails
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Patrick Toomey, first published at the original source. Preserved copies are kept so the citation survives its host.