In a 'persisted XSS' attack, the malicious content is 'static' and therefore could not possibly match the nonce which changes on every page request. Since the nonce value is unique for every page request, even if an attacker were able to inject a malicious script tag, the browser would refuse to evaluate it since it wouldn't contain a matching nonce attribute. The nonce is supplied in the HTTP header and must correspond to a nonce attribute that is explicitly added to every tag that is present on my blog. In my implementation, I'm using an HTTP response header - Content-Security-Policy - and a nonce (N-once), which is a one-time-use token generated uniquely on each request. And, hopefully, adding a Content Security Policy (CSP) is yet another weapon that I can use to help maintain the peace.Ī Content Security Policy defines which resources your browser is allowed to load and, which inline actions your browser is allowed to evaluate.

However, security is an ongoing arms race. Thankfully, malicious content is all-but-curbed through my use of spam detection, Anti-Samy HTML sanitization, and proper content encoding. And, while the vast, vast majority of you are amazing, beautiful people, some of you are garbage who want nothing more than to post malicious content.

This blog has, basically, two pieces of content: the blog posts that I write and, the comments that y'all write. In this post, I'm just sharing how I've implemented the CSP on this blog - hopefully I didn't screw anything up too bad. I also came across a CSP guide from Pete Freitag - one of the foremost security experts in our ColdFusion community. In order to get my Content Security Policy up and running, I just followed Google's guide on Strict CSPs. As such, I'm trying to become a good citizen. Meaning, security concerns are becoming everyone's concerns, not just that of the Security and/or Operations teams. But, the concept of security is increasingly shifting left in our industry. Let's be real clear here - I am not a security expert. A CSP is yet another line-of-defense in the war against Cross-Site Scripting (XSS) attacks.

But, one thing I've never had is a Content Security Policy (CSP). And when converting user-provided markdown into HTML, I use the OWASP Anti-Samy project to sanitize the HTML output. And, I use encodeForHtml() and encodeForHtmlAttribute() in as many places as is feasible. Of course, I've always used SQL query parameterization to block SQL injection attacks. As I continue to evolve my blogging platform, bringing it into the modern ColdFusion era, I'm trying to catch up on best practices.

Coldfusion generate random string