How c/side compares to others

Content Security Policies are a browser-side feature scoped by the W3 foundation.

Content security policies were designed to define which script sources and external connections are allowed to be loaded by a user's browser. A wide range of directives exist with varying levels of support across browsers. A web developer can manually define a list of sources allowed to be fetched for 3rd party scripts. Ideally defining them as specifically as possible using the full URL of a given script and then also using an md5 hash to verify the payload (aka the code) of the script. Some vendors provide tools to help developers define and keep these lists up to date. And some other tools use CSP under the hood.

CSP has a few really significant limitations marking its adoption. One of which is its strict max header length. This means that on many sites 3rd party script URLs are too long and as a result, the full domain gets allowlisted. Many major brands have wildcarded 3rd party sources that allow anyone on the web to submit code (think codesandbox.io) meaning such rules allow bad actors anyway.

In some cases, the security vendor will attempt to fetch the script for their own infrastructure separately from the browser using the source URL they received through a CSP report-only header. This makes it easy for a bad actor to circumvent the detection as when they see an IP range of a security or cloud vendor they simply won't respond or deliver a clean version of the script.

Similarly, dynamic script URLs may be built to only allow a single fetch which means the security vendor in question will never see the script that was served to a user.

A CSP violation, even a report-only violation will create an alarming-looking console error in the browser development tools:

In many security product spaces, threat feeds are still the standard today. Threat research companies crawl the web for known malicious patterns and add new domains that show malicious behaviors seen before. Some teams review social media sites (like Reddit or X) and monitor keywords people use in their tweets such as 'XSS', 'Magecart', 'Code Injection'... They then manually check if something is up. If it is, they often manually put it into a feed that is then consumed by cybersecurity firms and IT teams. This is a decent way of catching low-hanging fruit at a relatively low cost to the business.

Attackers however often monitor social media posts that flag their domain or the domains they managed to infiltrate making it very obvious when they are detected.

This manual human review-based approach is not perfect to say the least. Bad actors can quickly move their attack to a different domain without having to rewrite their malicious code. Especially in 2024 better ways to autonomously detect malicious patterns can be built, and that's what c/side built.