73 lines
3.9 KiB
HTML
73 lines
3.9 KiB
HTML
---
|
||
title: "cspresso Security"
|
||
description: "Security notes for cspresso: it runs a real browser; what bypassing existing CSP means; and how to use it safely."
|
||
---
|
||
<main class="py-5">
|
||
<div class="container">
|
||
<header class="mb-4">
|
||
<div class="kicker mb-2"><i class="bi bi-shield-lock"></i> Security</div>
|
||
<h1 class="display-6 fw-800 mb-2">Security notes</h1>
|
||
<p class="text-secondary mb-0">
|
||
cspresso runs a real browser. That’s the point - and also the main safety consideration.
|
||
</p>
|
||
</header>
|
||
|
||
<div class="row g-12">
|
||
<div class="col-lg-12">
|
||
<section class="mb-12">
|
||
<h2 class="section-title fw-bold">What cspresso does</h2>
|
||
<p class="text-secondary">
|
||
cspresso launches Chromium via Playwright and loads your target pages. The site’s JavaScript and CSS execute like a normal browser session.
|
||
Network requests are observed to build a draft CSP, and (optionally) a candidate policy is injected as Report‑Only to capture violations.
|
||
</p>
|
||
</section>
|
||
|
||
<section class="mb-12">
|
||
<h2 class="section-title fw-bold">About <code>--bypass-csp</code></h2>
|
||
<div class="callout p-4">
|
||
<div class="fw-semibold mb-2">It can change risk</div>
|
||
<div class="text-muted">
|
||
Bypassing CSP strips existing CSP headers on HTML responses. This option is provided in order to avoid the outcome of the rendering negatively influencing what cspresso thinks a good CSP should be.
|
||
If a site is compromised, CSP might have been limiting what injected scripts could do (that's the whole point of a CSP!); bypassing removes that layer.
|
||
</div>
|
||
<hr>
|
||
<div class="small text-secondary">
|
||
Recommendation: only use <code>--bypass-csp</code> on sites you trust, or run cspresso inside a sandboxed environment (VM/container).
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
<section class="mb-12">
|
||
<h2 class="section-title fw-bold">Data handling</h2>
|
||
<p class="text-secondary">
|
||
cspresso’s primary output is a policy string and metadata (visited URLs, notes, and - in evaluation mode - detected violations).
|
||
Treat the output as sensitive if your site URLs or CSP reveal internal endpoints.
|
||
</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h2 class="section-title fw-bold">Hardening tips</h2>
|
||
<div class="row g-3">
|
||
<div class="col-md-6"><div class="callout p-4 h-100">
|
||
<div class="fw-semibold mb-2">Prefer CI / disposable environments</div>
|
||
<div class="text-muted">Running in CI makes it easy to isolate and to cache Chromium via <code>--browsers-path</code>.</div>
|
||
</div></div>
|
||
<div class="col-md-6"><div class="callout p-4 h-100">
|
||
<div class="fw-semibold mb-2">Limit crawl scope</div>
|
||
<div class="text-muted">Keep <code>--max-pages</code> small and start from a stable landing page to reduce surprises.</div>
|
||
</div></div>
|
||
<div class="col-md-6"><div class="callout p-4 h-100">
|
||
<div class="fw-semibold mb-2">Review before enforcing</div>
|
||
<div class="text-muted">cspresso emits a draft. Tighten directives (especially <code>script-src</code>/<code>connect-src</code>) and consider nonces.</div>
|
||
</div></div>
|
||
<div class="col-md-6"><div class="callout p-4 h-100">
|
||
<div class="fw-semibold mb-2">Verify releases</div>
|
||
<div class="text-muted">mig5 key: <a class="link-secondary" href="https://mig5.net/static/mig5.asc" target="_blank" rel="noreferrer">https://mig5.net/static/mig5.asc</a><br>Fingerprint: <code>00AE817C24A10C2540461A9C1D7CDE0234DB458D</code></div>
|
||
</div></div>
|
||
</div>
|
||
</section>
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
</main>
|