CSP compliance through time
Date Issued
May 2026
Author(s)
Michailidis, Charalampos
Advisor
Abstract
Web applications have become a central part of everyday life as they are supporting a lot of services
like online banking, communication, healthcare and a lot of other utilities. As these systems continue to
evolve, they rely more heavily on dynamic content like external services and client-side scripting making
security increasingly difficult to manage.Among that the most common threats facing modern websites
are Cross-Site Scripting (XSS) attacks, where malicious code is executed inside a user’s browser through
a trusted application. To reduce the likelihood of those attacks to happen the browsers can use Content Security Policy (CSP) which is a mechanism that allows websites to define which resources are trusted and
allowed to execute in the browser. Although CSP is widely recommended as a second layer of defense
the implementation of it in practice is often inconsistent. a lot of web applications adjust their policies
over time to support new features, third-party libraries or even changing the development requirements
that they need over time. In a lot of cases those adjustments result in policies that become highly permissive with result to reduce the level of protection of Content Security Policy. This thesis intent to
investigates how CSP policy is changing over time and how these changes can affect the security state
of the current web applications. To study this behavior we have developed an automated framework to
collect and analyze CSP policies and browser resource activity from around 2,000 popular websites collected from the Tranco ranking list. This analysis was performed over multiple time periods and included
homepage, login, and sign up pages to be able to observe differences across different application context.
This collected data were used to analyze the policy modifications, CSP violations and resources to find
the overall strength of those policies. We have give a lot of attention to insecure practices such as the
use of wildcard sources and unsafe directives, which were commonly adopted to simplify development
but significantly weaken the protection of CSP given to the browser. The results we have find show us
that while CSP adoption is relatively common among popular websites but most of them using it with
unsecure configurations. As many websites rely on permissive configurations that prioritize functionality
and flexibility in development over secure configurations that will make the development more complex
and challenging. CSP directives like unsafe-inline, unsafe-eval and wildcard allowances were observed
in frequent base often reducing the effectiveness of CSP against XSS attacks. Also this thesis shows that
weak configurations have remained stable over time rather than improving suggesting us that insecure
practices are often maintained long term to avoid complex development with secure practices. In conclusion this work show us that the CSP policy is not used properly as it indent to be used for the security
purposes and highlights how important is to monitor that policy along with the resources in order to find
insecure practices
like online banking, communication, healthcare and a lot of other utilities. As these systems continue to
evolve, they rely more heavily on dynamic content like external services and client-side scripting making
security increasingly difficult to manage.Among that the most common threats facing modern websites
are Cross-Site Scripting (XSS) attacks, where malicious code is executed inside a user’s browser through
a trusted application. To reduce the likelihood of those attacks to happen the browsers can use Content Security Policy (CSP) which is a mechanism that allows websites to define which resources are trusted and
allowed to execute in the browser. Although CSP is widely recommended as a second layer of defense
the implementation of it in practice is often inconsistent. a lot of web applications adjust their policies
over time to support new features, third-party libraries or even changing the development requirements
that they need over time. In a lot of cases those adjustments result in policies that become highly permissive with result to reduce the level of protection of Content Security Policy. This thesis intent to
investigates how CSP policy is changing over time and how these changes can affect the security state
of the current web applications. To study this behavior we have developed an automated framework to
collect and analyze CSP policies and browser resource activity from around 2,000 popular websites collected from the Tranco ranking list. This analysis was performed over multiple time periods and included
homepage, login, and sign up pages to be able to observe differences across different application context.
This collected data were used to analyze the policy modifications, CSP violations and resources to find
the overall strength of those policies. We have give a lot of attention to insecure practices such as the
use of wildcard sources and unsafe directives, which were commonly adopted to simplify development
but significantly weaken the protection of CSP given to the browser. The results we have find show us
that while CSP adoption is relatively common among popular websites but most of them using it with
unsecure configurations. As many websites rely on permissive configurations that prioritize functionality
and flexibility in development over secure configurations that will make the development more complex
and challenging. CSP directives like unsafe-inline, unsafe-eval and wildcard allowances were observed
in frequent base often reducing the effectiveness of CSP against XSS attacks. Also this thesis shows that
weak configurations have remained stable over time rather than improving suggesting us that insecure
practices are often maintained long term to avoid complex development with secure practices. In conclusion this work show us that the CSP policy is not used properly as it indent to be used for the security
purposes and highlights how important is to monitor that policy along with the resources in order to find
insecure practices
Affiliation
File(s)![Thumbnail Image]()
Name
Charalampos Michailidis.msc.2026.abstract.pdf
Size
136.46 KB
Format
Adobe PDF
Checksum (MD5)
96ccfa59ecaed957342e6f2d3e0fe7d9