I ask because I once broke my website without ever refreshing my browser cache and I thought my CSP worked fine but then I decided to take it off because I feel like Content Security Policy is nothing more than a hindrance. Here is my website:
A few weeks ago, I moved from ClassicPress to my custom flat-file format because I wanted to get away from using a database for powering my website. All the Internet talks about is “why you should care about CSP” or “why you need CSP” without talking about whether CSP is appropriate for a personal website or not. Sure, there is documentation regarding Content Security Policy on the Internet, but I feel like this whole thing about documentation is JUST not enough. I mean, I struggle with Content Security Policy a whole lot. It’s like there is not enough documentation that covers recommendations on what CSP works best for my website.
I once used nonces (that I randomly created without knowing what I am doing) to using inline-unsafe for styles (I know: very bad practice) when I moved to flat file and got rid of JavaScript code, but it just so happens that when I set default-src to none while setting styles, media, and images to self and data:, I thought it worked fine later to find out in a later time that I broke my website using Content Security Policy.
With that in mind, if I only use assets stored in my VPS server, is it possible for anyone to cause a cross-site-scripting attack against my website?
How about my router.php? Are there any vulnerabilities to be aware of?
<?php
class Router
{
function __construct()
{
$root = $_SERVER['DOCUMENT_ROOT'];
$url = "";
$isCategory = false;
require_once($root.'/ctrl/homecontroller.php');
$controller = new HomeController();
if(isset($_GET['url']) &&
$_GET['url'] != "index.php")
{
$arrayURL = explode('/', filter_var(rtrim($_GET['url'], '/'),
FILTER_SANITIZE_URL));
if($arrayURL[0] == "sitemap.php")
{
require_once($root.'/sitemap.php');
return;
}
if($arrayURL[0] == "category")
$isCategory = true;
$url = join('/',$arrayURL);
if($isCategory)
{
call_user_func_array([$controller,"getBlogPostsByCategory"],
[$root,$url]);
}
else
{
call_user_func_array([$controller,"viewPage"],
[$root,$arrayURL[0]]);
}
}
else if(isset($_GET['page']))
{
if(is_numeric($_GET['page']))
call_user_func_array([$controller,"index"],[$root,$_GET['page']]);
else call_user_func_array([$controller,"error"],
[$root]);
}
else
{
$qstrNum = count(explode('&', $_SERVER['QUERY_STRING']));
if($qstrNum > 1)
{
call_user_func_array([$controller,"error"],[$root]);
}
else
{
call_user_func_array([$controller,"index"],[$root]);
}
}
}
}
I do use mod_security that reports a forbidden when I try to do something like ?q=/bin/falseI even tried doing page= but I got a forbidden as well from my Apache server. Of course, I’m pretty sure there might be workarounds in order to cause havoc to my site that I’m not aware of. This is more of a server-side and not client-side which I have concerns with when it comes to using Content Security Policy.
In my experience and in my opinion, the more I harden my website for security, the more likely it’s going to break, but that’s just me.
Update: I think I found a solution:
Header set Content-Security-Policy "default-src https://graysonpeddie.com 'unsafe-inline' data:; script-src 'none'; img-src 'self' data:; media-src 'self' data:;"
This may not be secure at all, but at least I now have the basic Content Security Policy in place. Yes, unsafe-inline is very bad, but I’d rather take the easy route instead of knowing how to set nounces properly… Content Security Policy is a pain…
