12 Angry Developers - A Qualitative Study on Developers' Struggles with CSP
Sebastian Roth, Lea Gröber, Michael Backes, Katharina Krombholz, Ben Stock
Abstract
The Web has improved our ways of communicating, collaborating, teaching, and entertaining us and our fellow human beings. However, this cornerstone of our modern society is also one of the main targets of attacks, most prominently Cross-Site Scripting (XSS). A correctly crafted Content Security Policy (CSP) is capable of effectively mitigating the effect of those Cross-Site Scripting attacks. However, research has shown that the vast majority of all policies in the wild are trivially bypassable.
Ask about this paper
Ask your agent about it.
Lune has read the top-tier papers around this one, so every answer names the papers it rests on.
Your agent calls
Lunesearch_papers
Free to start. No credit card required.
Terminal
Install the CLIlune papers get 3f06582b-327a-45aa-8e71-e1d54c807e60Cited by top-tier papers8
- Different Researchers, Different Results? Analyzing the Influence of Researcher Experience and Data Type During Qualitative Analysis of an Interview and Survey Study on Security AdviceAnna-Marie Ortloff, Matthias Fassl, Alexander Ponticello, Florin Martius et al.CHI 2023 · 38 citations
- Digital Disparities: A Comparative Web Measurement Study Across Economic BoundariesMasudul Hasan Masud Bhuiyan, Matteo Varvello, Cristian-Alexandru Staicu, Yasir ZakiWWW 2025 · 5 citations
- Trust Me If You Can - How Usable Is Trusted Types In Practice?Sebastian Roth, Lea Gröber, Philipp Baus, Katharina Krombholz et al.USENIX Security 2024 · 3 citations
- It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain SecurityMarcel Fourné, Dominik Wermke, William Enck, Sascha Fahl et al.S&P 2023
- BUIzz: Finding Policy Enforcement Bugs via Interaction Simulation on the Browser User InterfaceMingi Jung, Donggyu Kim, Mijung Kim, Seongil WiUSENIX Security 2026
Related papers
- CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security PolicyLukas Weichselbaum, Michele Spagnuolo, Sebastian Lekies, Artur JancCCS 2016 · 114 citations
- CSPAutoGen: Black-box Enforcement of Content Security Policy upon Real-world WebsitesXiang Pan, Yinzhi Cao, Shuangping Liu, Yu Zhou et al.CCS 2016 · 55 citations
- CCSP: Controlled Relaxation of Content Security Policies by Runtime Policy CompositionStefano Calzavara, Alvise Rabitti, Michele BugliesiUSENIX Security 2017 · 15 citations
- Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script GadgetsSebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava et al.CCS 2017 · 62 citations
- DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential TestingSeongil Wi, Trung Tin Nguyen, Jihwan Kim, Ben Stock et al.NDSS 2023
