Tracking and whitelisting third-party domains
Disclosed herein are methods, systems, and processes to track and whitelist third-party domains. A web request is received from a computing device. A Content Security Policy (CSP) header set is generated based on rule conditions and transmitted to the computing device. A violation notice indicating that third party domains used to render the web request violate one or more rule conditions identified by the CSP header set is received from the computing device. The third party domains are blocked as part of performing the web request.
1. A computer-implemented method, comprising:
receiving, by a web server, a web request from a browser executing on a computing device, the web request requesting a web page hosted by the web server;
generating, by the web server, a Content Security Policy (CSP) header set based on a plurality of rule conditions that are set using a feature toggle system associated with the web server;
transmitting, by the web server, the CSP header set to the browser executing on the computing device;
receiving, by the web server, a violation notice from the browser executing on the computing device indicating that one or more third party domains of a plurality of third party domains used to render the web request violate at least one rule condition of the plurality of rule conditions identified by the CSP header set;
determining, by the web server, that at least one third party domain of the one or more third party domains is not included in a whitelist lookup file;
blocking the at least one third party domain based at least in part in determining that the at least one third party domain is not included in the whitelist lookup file;
triggering an application programming interface (API) call to the feature toggle system based at least in part on determining that the at least one third party domain is not part of the whitelist lookup file, the API call to the feature toggle system updating the whitelist lookup file by modifying the plurality of rule conditions in the feature toggle system to include the at least one third party domain; and
performing the web request.
2. The computer-implemented method of claim 1 , further comprising:
accessing the whitelist lookup file;
performing a comparison of the violation notice with the whitelist lookup file; and
generating an alert notice based on the comparison based at least in part on determining that the at least one third party domain is not included in the whitelist lookup file.
3. The computer-implemented method of claim 1 , wherein: the feature toggle system manages the plurality of rule conditions; and the plurality of rule conditions apply to at least one of: a tag, a tag container, and a domain associated with the web request.
4. The computer-implemented method of claim 1 , wherein:
the violation notice is received from the browser via a universal resource locator (URL) provided by the web server.
5. The computer-implemented method of claim 1 , wherein
the plurality of rule conditions are retrieved by the feature toggle system.
6. The computer-implemented method of claim 1 , further comprising:
intercepting one or more third party calls generated for the one or more third party domains used to render the web request.
7. The computer-implemented method of claim 1 , wherein the CSP header set comprises:
one or more CSP report only headers; and
one or more CSP headers.
8. A non-transitory computer readable storage medium comprising program instructions executable by one or more processors of a web server to:
receive a web request from a browser executing on a computing device, the web request requesting a web page hosted by the web server;
generate a Content Security Policy (CSP) header set based on a plurality of rule conditions that are set using a feature toggle system associated with the web server;
transmit the CSP header set from the web server to the browser executing on the computing device;
receive a violation notice from the browser executing on the computing device indicating that one or more third party domains of a plurality of third party domains used to render the web request violate at least one rule condition of the plurality of rule conditions identified by the CSP header set;
determine that at least one third party domain of the one or more third party domains is not included in a whitelist lookup file;
block the at least one third party domain based at least in part in determining that the at least one third party domain is not included in the whitelist lookup file;
trigger an application programming interface (API) call to the feature toggle system based at least in part on determining that the at least one third party domain is not part of the whitelist lookup file, the API call to the feature toggle system updating the whitelist lookup file by modifying the plurality of rule conditions in the feature toggle system to include the at least one third party domain; and
perform the web request.
9. The non-transitory computer readable storage medium of claim 8 , further comprising:
access the whitelist lookup file;
perform a comparison of the violation notice with the whitelist lookup file; and
generate an alert notice based on the comparison and based on determining that the at least one third party domain is not included in the whitelist lookup file.
10. The non-transitory computer readable storage medium of claim 8 , wherein
the feature toggle system manages the plurality of rule conditions; and
the plurality of rule conditions apply to: a tag, a tag container, and a domain associated with the web request.
11. The non-transitory computer readable storage medium of claim 8 , wherein:
the violation notice is received from the browser via a universal resource locator (URL) provided by the web server.
12. The non-transitory computer readable storage medium of claim 8 , wherein
the plurality of rule conditions are retrieved by the feature toggle system.
13. The non-transitory computer readable storage medium of claim 8 , further comprising:
intercept one or more third party calls generated for the one or more third party domains used to render the web request.
14. The non-transitory computer readable storage medium of claim 8 , wherein the CSP header set comprises:
one or more CSP report only headers; and
one or more CSP headers.
15. A web server comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
receive a web request from a browser executing on a computing device;
generate a Content Security Policy (CSP) header set based on a plurality of rule conditions that are set using a feature toggle system associated with the web server;
transmit the CSP header set to the browser executing on the computing device;
receive a violation notice from the browser executing on the computing device indicating that one or more third party domains of a plurality of third party domains used to render the web request violate at least one rule condition of the plurality of rule conditions identified by the CSP header set;
determine that at least one third party domain of the one or more third party domains is not included in a whitelist lookup file;
block the at least one third party domain based at least in part in determining that the at least one third party domain is not included in the whitelist lookup file;
trigger an application programming interface (API) call to the feature toggle system based at least in part on determining that the at least one third party domain is not part of the whitelist lookup file, the API call to the feature toggle system updating the whitelist lookup file by modifying the plurality of rule conditions in the feature toggle system to include the at least one third party domain; and
perform the web request.
16. The web server of claim 15 , the program instructions further executable by the one or more processors to:
access the whitelist lookup file;
perform a comparison of the violation notice with the whitelist lookup file; and
generate an alert notice based on the comparison and based on determining that the at least one third party domain is not included in the whitelist lookup file.
17. The web server of claim 15 , wherein
the feature toggle system manages the plurality of rule conditions; and
the plurality of rule conditions apply to: a tag, a tag container, and a domain associated with the web request.
18. The web server of claim 15 , wherein:
the violation notice is received from the browser via a universal resource locator (URL) provided by the web server.
19. The web server of claim 15 , wherein
the plurality of rule conditions are retrieved by the feature toggle system, and
the CSP header set comprises:
one or more CSP report only headers; and
one or more CSP headers.
20. The web server of claim 15 , the program instructions further executable by the one or more processors to:
intercept one or more third party calls generated for the one or more third party domains used to render the web request.