Collaborate Disseminate
The description from Mozilla warns that require-sri-for is obsolete and may be removed at any time.
The feature seems useful, especially for large websites where it’s likely that a developer may forget to include an integrit… Continue reading Why is CSP require-sri-for marked as obsolete?
There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past.
X-XSS Protection: 1; mode=block
Content-Security-Policy: refl… Continue reading What was the real reason for dropping reflected-xss directive from CSP?
I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server.
I wanted to write my Content Security Policy in a way to permit all local stylesheets, and only this one… Continue reading Why does Chrome claim that this stylesheet violates the Content Security Policy?
A bank claims that its customer login pages cannot be cached – apparently because there’s some unique number associated with each instance of a page rendered on the client browser. Supposedly, a customer trying to log in to t… Continue reading protecting login pages of a bank using CDN and TLS [closed]
I have an img tag on a page with an line style that looks like this:
style=”height:50px;width:180px;display:block;”
I can’t move it to an external stylesheet because the img tag is generated by a 3rd party control. So I co… Continue reading Content Security Policy Style Hash
I was reading up on CSP’s and I did some testing on a site which had one implemented, I found an xss vulnerability even though it was using a CSP.
Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest Open/Send which then check … Continue reading Off the shelf JavaScript based CSP alternative – is it safe?
So in a CSP like the below:
content-security-policy: upgrade-insecure-requests; frame-ancestors ‘self’ https://stackexchange.com
Should the url part be quoted like this (example from mozilla security) – even though this exa… Continue reading In a constent security policy header: Should the url’s be quoted or not, and is there any security implication to this decision?
I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a password leaks. Many of the… Continue reading How safe is it to allow JS CDNs in a HTTP content security policy?
Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline script hashes and the in… Continue reading Content Security Policy (CSP) alternatives