Collaborate Disseminate
On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to ‘self’ would be sufficient. Some parts however still… Continue reading nonce generation based on php session id
My understanding is that:
SVGs offer far greater functionality if they are directly embedded in a site’s HTML code via the <svg> tag than if they are linked to via the <img> tag
For example, if the <svg> tag is used, it… Continue reading Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?
Lets say I’ll open a third party page from the parent page using window.open(popup method)
Now what I want to know is there any way where the parent page(using javascript or any third party library) which opened the popup can get info back… Continue reading Can javascript from parent page read url of popup window?
Can anyone help me to understand what is this means?
TTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Link: <https://****.com/wp-json/>; rel="https://api.w.org/"
Link: <https://*****/wp-json/wp… Continue reading Content Security Policy (CSP) Header Not Set [closed]
I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question.
1-) I am keeping user’s id in session[:authID], is it safe to use like this?
2-) Do i need CSRF protection for api-only? I’m using Next.js for clien… Continue reading Rails API Session Security and CSRF
i am trying to secure my apache web server myself before go live so i added these security headers to my apache site.conf file after lot of reading and googling. i know we can not secure a server 100% but 99% i know there are lot of securi… Continue reading securing apache webserver using security headers
Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used.
Content-Security-Policy: report-uri https://www.example.com
Does the above directive where only report-uri is used … Continue reading Report-URI CSP Directive
When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header.
However, there is a API endpoint which ref… Continue reading CORS request is not sending Authorization: Bearer <value> header
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-src ‘self’">
Out of the above t… Continue reading Which CSP implementation is more secure?
"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents."
In a situation where www.attacker.com opens www.tagetwebs… Continue reading What is the difference between Cross Origin Opener Policy and SOP?