Demystifying CSP for modern applications - Philippe De Ryck - NDC Oslo 2026

Item: Demystifying CSP for modern applications - Philippe De Ryck - NDC Oslo 2026
Rating: 5
Author: PostSingularity Institute

by Philippe De Ryck · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information Technology URComputer security

🎙 Philippe De Ryck 👥 230K 📅 October 14, 2026 ⏱ 61 min 👁 28 📄 tutorial 🧭 2026-10-14

Available in: English (current) Français

Keywords

Content Security Policynoncehashscript executioncross-site scripting

Summary

The talk presents a deep dive into Content Security Policy (CSP) for modern web applications. Philippe De Ryck starts by showing that many websites have ineffective CSP policies, then explains the history and purpose of CSP as a second line of defense against XSS. He demonstrates how CSP blocks malicious scripts, then discusses the three ways to enable inline script execution: unsafe-inline, hashes, and nonces. He strongly discourages unsafe-inline, shows how to use hashes for static code, and nonces for dynamic pages. The talk concludes with practical deployment strategies for SPAs and actionable guidelines for configuring secure CSP policies.

99 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high, as it offers concrete and practical advice on configuring CSP correctly, based on real-world examples and live demonstrations. The argumentation is solid: the speaker explains why common policies fail, demonstrates the attacks, and shows how to properly implement countermeasures. He emphasizes the importance of controlling script execution and provides clear reasoning for each recommendation.

Scientific Rigor, Source Quality, Title Accuracy

The rigor is high: the speaker is a Google Developer Expert and security consultant, and he presents accurate technical details. He sources his claims with practical demos and references the CSP specification implicitly. The title matches the content perfectly. No comments were provided in the input data, so no trends can be analyzed.

129 words

Title / Content Match

The title accurately reflects the content: the talk explains and demystifies CSP for modern web applications.

Quality & Reliability

9/10

Talk by a recognized security expert with practical demos, clear explanations, and accurate technical details. The claims are well-supported and the presentation is rigorous.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

NDC Conferences — Official conference page for NDC events, where the talk was recorded.
NDC Oslo — Official page for NDC Oslo, the event where this talk was given.

Contribution & Novelties

The talk provides a clear, demystifying overview of CSP that distills years of practical experience into actionable guidelines. It highlights common pitfalls (unsafe-inline, ineffective policies) and offers concrete techniques (hashes, nonces) that developers can immediately apply. It also addresses deployment strategies for single-page applications, which is often a pain point.

Pour aller plus loin :

Content Security Policy Level 3 (W3C Specification) — The official spec defining CSP features.
Cross-Site Scripting (XSS) - OWASP — Comprehensive resource on XSS attacks, the primary threat CSP mitigates.
Content Security Policy (MDN Web Docs) — Practical reference and guidance for implementing CSP in web applications.

102 words

Radar Profile

The radar profile shows high scores across quantity, quality, technical level, and reliability, indicating a balanced and well-executed technical presentation.

Reliability 9/10