Collaborate Disseminate
I was recently testing for Clickjacking and when I opened developer tools, I was warning
Content Security Policy: Ignoring “’unsafe-inline’” within script-src or style-src: nonce-source or hash-source specified
Do you guys think it is poss… Continue reading Error on Content Security Policy while testing for Clickjacking
Tala’s Global Data at Risk: 2020 State of the Web Report indicates that sensitive data like PII and credit card information has never been more at risk – and security effectiveness is declining.
The post 92% of the world’s top websites… Continue reading 92% of the world’s top websites expose customer data to attackers
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn’t figure out how to go about it. We then approached SAP directly and even their solutions are not working, and their support team has… Continue reading Enabling HTTP Security headers in S/4 Hana web applications
Consider the below scenario:
There’s a checkout webpage that can be accessed at checkout.example.com. This page has decent security policy. But just to prevent any credit card info leakage, credit card information editing panel is in an if… Continue reading Security Benefits of Having a Content Security Policy for a Domain Loaded through iframe
Slow websites lose customers and hurt conversions. Fortunately, you don’t have to sacrifice performance for security, says Tala CTO Swapnil Bhalode.
The post If security is slowing down your website’s performance, you’re doing it wron… Continue reading If security is slowing down your website’s performance, you’re doing it wrong.
Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?
Continue reading Content-Security-Policy (CSP) HTTP Header useful for direct link to image?
Data protection, controls and compliance don’t have to be an onerous obligation. With the right approach, you can turn it into a key differentiator for your business, says Tala’s Director of Product Management, Deepika Gajaria.
The pos… Continue reading It’s all about the data
Taking the example of an HTML page with meta elements. You could either define the CSP in the meta tags of the HTML, or use JavaScript to insert a new meta element as a sibling of the existing meta elements.
Assuming the dynamical insert … Continue reading Are there any known attacks against a dynamically inserted Content Security Policy?
I have a website developed using VueJS (i.e. its a single page application). I’ve been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I realised I would have to allow ‘unsafe-inline… Continue reading Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?
Third-party tools have transformed your online presence – but you need to secure them or it will all be for nothing. Doing that starts with asking your vendor the right questions, says Tala VP of Engineering, Sanjay Sawhney.
The post Evaluating cl… Continue reading Evaluating client-side web security: questions to ask your vendor