The document discusses various browser security mechanisms that can help improve the security of web applications. It describes mechanisms like subresource integrity, which prevents tampering of external assets; referrer policy and noopener, which help prevent information leaks; and Content Security Policy, which helps prevent cross-site scripting attacks. It also discusses using HTTPS, HTTP-only and secure cookies, sandboxed iframes, and HTTP Strict Transport Security to further enhance security. The document provides explanations and examples of how to implement many of these browser-enforced security mechanisms.

1. François Marier @fmarier
Getting Browsers to Improve
the Security of Your Webapp

2. external
resources
user
content
cookies encryption

3. external
resources

4. Subresource integrity
mechanism for preventing
tampering of static assets

7. https://ajax.googleapis.com/ajax
/libs/jquery/1.9.1/jquery.min.js

8. what would happen if that
server were compromised?

10. Bad Things™
steal sessions
leak confidential data
redirect to phishing sites
enlist DDoS zombies

11. simple solution

12. instead of this:
<script
src=”https://ajax.googleapis.com...”>
integrity=”sha256-1z4uG/+cVbhShP...”
crossorigin=”anonymous”>

13. <script
src=”https://ajax.googleapis.com...”>
integrity=”sha256-1z4uG/+cVbhShP...”
crossorigin=”anonymous”>
do this:

14. guarantee:
script won't change
or it'll be blocked

15. rel=”noopener”
mechanism for disabling the
window.opener object

16. My Account
● Change my address
● Change my billing card
● Reset my password
● Delete my account
● Watch some cute kittens!

17. My Account
● Change my address
● Change my billing card
● Reset my password
● Delete my account
● Watch some cute kittens!
kittens!!!!!!!!

18. <a href=”...” target=”_blank”>

19. window.opener.location

20. window.opener.location

21. window.opener.location =
'http://stealmypasswd.org';

22. My Account
● Change my address
● Change my billing card
● Reset my password
● Delete my account
● Watch some cute kittens!
kittens!!!!!!!!

23. Session Expired
Username:
Password:
Log back in!
kittens!!!!!!!!

24. Session Expired
Username:
Password:
Log back in!
esnowden
**********

25. My Account
● Change my address
● Change my billing card
● Reset my password
● Delete my account
● Watch some cute kittens!

26. solutions

27. <a href=”...” target=”_blank”>

28. <a href=”...” target=”_blank”
rel=”noopener”>

29. window.opener == null

30. Referrer Policy
mechanism for trimming
the Referer header

32. http://example.com/search?q=serious+medical+condition
Click here for
the cheapest
insurance
around!
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla.

34. Referrer-Policy: no-referrer
<meta name="referrer" content="origin">
<a href="http://example.com" referrer="origin">

35. Referrer-Policy: no-referrer
<meta name="referrer" content="no-referrer">
<a href="http://example.com" referrer="origin">

36. Referrer-Policy: no-referrer
<meta name="referrer" content="no-referrer">
<a href="http://example.com"
referrerPolicy="no-referrer">

37. no-referrer
no-referrer-when-downgrade
same-origin
strict-origin
strict-origin-when-cross-origin

38. no-referrer
no-referrer-when-downgrade
same-origin
strict-origin
strict-origin-when-cross-origin

39. no-referrer
no-referrer-when-downgrade
same-origin
strict-origin
strict-origin-when-cross-origin

40. no-referrer
no-referrer-when-downgrade
same-origin
strict-origin-when-cross-origin

41. no-referrer
no-referrer-when-downgrade
same-origin
strict-origin-when-cross-origin
https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy

42. user
content

43. Sandboxed iframes
mechanism for restricting
embedded documents

44. <iframe src=”resume.html”>

45. window.parent

46. seriousapp.com
seriousappusercontent.com

47. <iframe src=”resume.html”
sandbox=””>

48. scripts
popups
forms

49. scripts
popups
forms
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

50. X-Content-Type-Options
mechanism for disabling
content type sniffing

51. PDF

52. Review Papers
● Witty-Title.pdf
● Serious-Sounding-Topic.pdf
● Series-of-buzzwords.pdf
● Celebrity-Paper.pdf
● Half-Ass-Paper.pdf

53. %PDF-1.5
<html>
<body>
<script>
...
</script>
</body>
</html>

54. %PDF-1.5
<html>
<body>
<script>
...
</script>
</body>
</html>

55. <form action=”review.cgi”>
<input type=”hidden”
name=”paper-id”
value=”42”>
<input type=”hidden”
name=”score”
value=”100”>
</form>

56. X-Content-Type-Options: nosniff

57. Content Security Policy
aka CSP
mechanism for preventing XSS

58. telling the browser the content
that is allowed to load

59. Hi y'all<script>
alert('p0wned');
</script>!
Tweet!
What's on your mind?

60. without CSP

61. Hi y'all!
John Doe - just moments ago
p0wned
Ok

62. with CSP

63. Hi y'all!
John Doe - just moments ago

64. Content-Security-Policy:
script-src 'self'
https://cdn.example.com

65. script-src
object-src
style-src
img-src
media-src
font-src
connect-src
...

66. script-src
object-src
style-src
img-src
media-src
font-src
connect-src
...
https://developer.mozilla.org/docs/Web/HTTP/CSP

67. cookies

69. 1234

70. Set-Cookie: sessionid=1234

71. 1234

72. 1234

73. document.cookie

74. Cookie options
mechanism for restricting
the scope of cookies

75. Set-Cookie: sessionid=1234;
httponly

76. document.cookie == null

77. Set-Cookie: sessionid=1234;
secure

78. 1234

80. good, but not great

81. 1234

82. Set-Cookie: sessionid=1234

83. 1234

84. 666

85. 666

86. Cookie prefixes
mechanism for enforcing
cookie restrictions

87. Set-Cookie: __Secure-sessionid=1234;
secure

88. __Secure-sessionid=666

90. encryption

91. HTTPS
mechanism for securing
information in transit

92. if you're not using it, now is the time to start :)

94. HTTPS is not enough
you need to do it properly

95. RC4

96. SHA-1
RC4

97. SHA-11024-bit certificates
RC4

98. SHA-11024-bit certificates
RC4 weak DH parameters

100. https://mozilla.github.io/server-side-tls/ssl-config-generator/

101. https://www.ssllabs.com/ssltest/

102. Strict Transport Security
aka HSTS
mechanism for preventing
HTTPS to HTTP downgrades

103. telling the browser that your site
should never be reached over HTTP

105. GET bank.com 301→
GET https://bank.com 200→
no HSTS, no sslstrip

106. GET bank.com → 200
no HSTS, with sslstrip

107. what does HSTS look like?

108. Strict-Transport-Security: max-age=31536000

109. with HSTS, with sslstrip
GET https://bank.com 200→

110. no HTTP traffic for
sslstrip to tamper with

111. https://hstspreload.org/

112. referrer policy
subresource integrity
noopener
cookie prefixes
cookie options
sandboxed iframes
x-content-type-options
content security policy
https
strict transport
security

113. Questions?
feedback:
francois@mozilla.com
@fmarier
mozilla.dev.security
© 2017 François Marier <francois@mozilla.com>
This work is licensed under a
Creative Commons Attribution-ShareAlike 4.0 License.

114. photo credits:
explosion: https://www.flickr.com/photos/-cavin-/2313239884/
kittens: https://www.flickr.com/photos/londonlooks/5693093073
cookie: https://www.flickr.com/photos/amagill/34754258/