Collected research

GitHubs post-CSP journey

GitHub's post-CSP journey

Patrick Toomey · The GitHub Blog · 19 January 2017

Once CSP stops script execution, attackers steal page secrets with dangling markup: an unclosed img src swallows the CSRF token, and permitted image hosts such as Google Analytics and Gravatar become exfiltration endpoints. GitHub answers with a stricter img-src, markup-closing prefixes before forms, per-form CSRF tokens and a SameSite session cookie.

Record

Document

GitHub's post-CSP journey

Researcher

Patrick Toomey

Published by

The GitHub Blog

Date

19 January 2017

Topic

XSS

In the archive

• Collected in the 2016–17 research round

Related sources

• GitHub’s CSP journey
• Per-form CSRF tokens in Rails

Tags

• csp
• csrf
• info-leak
• cookie
• injection
• mitigation
• defence
• github
• rails
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Patrick Toomey, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.