How Latest Browser Security Features Eliminate Bug Classes

### Overview In this talk, an application security practitioner at Sage shares how modern browser security mechanisms can eliminate entire bug classes rather than just patching individual vulnerabilities reactively. Highlighting the persistence of cross-site scripting (XSS) and cross-site request forgery (CSRF)—which remain top issues in OWASP and HackerOne rankings—the speaker references the updated OWASP Proactive Controls (2024), specifically Control #8: "Leverage Browser Security Features." Taking inspiration from a Google case study that scaled and measured Content Security Policy (CSP) adoption across hundreds of services using passive reverse-proxy signals, the presentation details how development teams can move toward secure-by-default web architectures.

### Key Topics - **The Shift from Symptom Fixing to Bug Class Elimination**: Moving away from the reactive "whack-a-mole" cycle of fixing individual reports to adopting defense-in-depth platform controls. - **OWASP Proactive Controls & Measuring Adoption**: Utilizing reverse proxies or cloud firewalls to passively monitor security signals (e.g., strict CSP, framing controls, fetch metadata) and compiling scorecard metrics across services. - **Sec-Fetch Metadata Headers**: Mitigating CSRF and cross-origin abuse via client-sent request metadata headers (`Sec-Fetch-Site`, `Sec-Fetch-Mode`, `Sec-Fetch-Dest`). - **Strict Content Security Policy (CSP)**: Eliminating common XSS vectors by avoiding easily bypassed CDN allowlists and adopting nonces or integrity checks, facilitated by report-only modes and evaluation tools. - **Trusted Types & DOM XSS**: Constraining dangerous DOM APIs (`innerHTML`, `document.write`) via policies and sanitization libraries (e.g., DOMPurify). - **Emerging Browser Standards**: Upcoming features such as Mozilla's `Integrity-Policy` header, the unified Reporting API (`Reporting-Endpoints`), and the native browser Sanitizer API (`setHTML`).

### Technical Details - **Sec-Fetch Metadata vs. Traditional CSRF Defenses**: Traditional mitigations rely on anti-CSRF tokens, SameSite cookies, or double-submit cookies. `Sec-Fetch-*` headers provide request context directly from modern browsers. An edge proxy (such as NGINX) or backend can inspect `Sec-Fetch-Site` and immediately block unwanted cross-site requests using a simple conditional check, without touching legacy browser traffic or altering core application logic. - **Strict CSP vs. Allowlist Pitfalls**: Classic domain allowlists often fall prey to bypasses (demonstrated via tools like CSP Bypass and CSP Evaluator) when hosting JSONP endpoints or CDN-hosted scripts (e.g., Google accounts, DoubleClick). A strict CSP replaces allowlists with cryptographic nonces (`'nonce-...'`) or subresource integrity checks to prevent unauthorized script execution. Teams can iteratively roll this out using `Content-Security-Policy-Report-Only`. - **Trusted Types Implementation**: Trusted Types mitigate DOM-based XSS by overriding direct assignments to sinks like `element.innerHTML`. Instead, applications define a policy that invokes an HTML sanitizer like DOMPurify or enforces safe text assignments, scaling across large legacy codebases without complete rewrites. - **New and Upcoming Headers**: - `Integrity-Policy`: A response header currently being developed by Mozilla to specify hashes for external resources, addressing risks demonstrated by incidents like the polyfill.io supply chain compromise. - `Reporting-Endpoints`: Deprecates `report-uri` inside CSP, serving as a unified header to collect multiple types of platform violation reports (CSP, CORS, integrity). - Native Sanitizer API (`setHTML`): Moving HTML sanitization into the browser runtime itself, currently surfacing in Firefox Nightly.

### Takeaways Web security is increasingly opt-in, placing the responsibility on developers and security teams to deliberately enable modern browser protections. Quick wins such as filtering `Sec-Fetch-*` metadata at the reverse proxy can block CSRF at scale. For CSP, teams should deploy report-only modes in pre-production or test environments to prevent logging pipelines from being overwhelmed, eliminate weak domain allowlists in favor of nonces, and adopt emerging browser native standards like Trusted Types and native sanitizers to eliminate XSS bug classes entirely.