Which Sites have Content Security Policy to prevent XSS

Analysis
1

I was interested in looking at the leaderboard for the sites that enable content security policy which offers a certain protection from third party JS used to attack a first party site (like recent GitHub attack)

SELECT domain(url) as domainname, count(*) as num
FROM [httparchive:runs.latest_requests]
WHERE lower(respOtherHeaders) contains "content-security-policy" 
GROUP BY domainname 
ORDER BY num desc

which shows Twitter, Google and GitHub to be leaders (sadly expected to see more bigname properties also enable it…hint hint :wink:

2

Awesome work, @pganti! Here’s a similar query I did in the past.

http://bigqueri.es/t/how-many-resources-have-x-frame-options-strict-transport-security-or-content-security-policy-headers-for-web-app-security/155

Looks like there’s been some decent adoption since then.

BTW, much of the work getting CSP in place at twitter and github is the work of Neil (@ndm).