Datadog has a security footgun
Open link in next tab
Datadog has a security footgun
https://sheriffcranky.substack.com/p/datadog-has-a-security-footgun
Bad API design leads to field day for domain-snatching data siphons
https://sheriffcranky.substack.com/p/datadog-has-a-security-footgun
Bad API design leads to field day for domain-snatching data siphons
My takeaway from this is to use CSP to minimize your reliance on others doing things intelligently. And that Datadog is not doing things intelligently at the inconvenience of their consumers.
Unfortunately, retrofitting CSP on an existing site can be nightmare, especially if you have external dependencies. At my job, we spent months trying to enable CSP on one our oldest sites, but ultimately gave up because one of our dependencies won't work unless we added "unsafe-inline" everywhere, which kinda defeats the whole point of CSP.
Having something is better than nothing! In our case, having connect-src enabled would have avoided the incident.