content-security-policy

How to make Google Tag Manager and Content-Security-Policy coexist?

阅读更多关于 How to make Google Tag Manager and Content-Security-Policy coexist?

问题 The Content-Security-Policy (CSP) header aims to protect your application against malicious resource injection in your web apps. To make it simple, you provide a whitelist of allowed domain origins for all your images, scripts, styles and so on. Meanwhile, Marketing team is using Google Tag Manager (GTM) to manage tags. The principle is to gather information from a page, send them to GTM and use those data as variables to generate tags, a mix of templated JS/HTML and those variables. The

Content Security Policy does not work in Internet Explorer 11

阅读更多关于 Content Security Policy does not work in Internet Explorer 11

In my asp.net core application for each response i'm adding content security policy header. I understand that for IE, the header name is X-Content-Security-Policy and for other browsers like chrome its Content-Security-Policy The header value looks something like below where nonce is different for each response. default-src 'none'; script-src 'self' 'nonce-somerandomvalue-differnt-foreach-reasone' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'self'; connect-src 'self'; report-uri /csp/report; The application is using inline javascript on

CSP: child-src and frame-src deprecated

阅读更多关于 CSP: child-src and frame-src deprecated

In CSP v2 frame-src was deprecated. child-src is recommended to use instead. In CSP v3 frame-src in undeprecated and child-src is deprecated. Currently (sep 2017) Chrome: The 'child-src' directive is deprecated and will be removed in M60, around August 2017. Please use the 'script-src' directive for Workers instead. So what's correct collection of directives to work in modern (minus 2 versions) browsers? Looks like frame-src + script-src is enough? But what should be in script-src then? PS: is it even legal to "undeprecate" stuff? 2018-12-20 update child-src has in the meantime been un

Why would I get a CSP violation for the blocked-uri 'about'?

阅读更多关于 Why would I get a CSP violation for the blocked-uri 'about'?

My CSP report URI has received the following CSP violation: { "csp-report":{ "document-uri":"https://example.com/blog/somepage", "referrer":"", "violated-directive":"img-src 'self' data: p.typekit.net pbs.twimg.com platform.twitter.com q.stripe.com syndication.twitter.com", "effective-directive":"img-src", "original-policy": veryLongPolicyGoesHere, "blocked-uri":"about", "status-code":0 } } Why would I get a CSP violation for the blocked-uri 'about'? Is this the inbuilt about: URL from web browsers? I can't replicate the problem when I try. Tomi Junnila I worked with the user to discover it is

Custom HTTP headers with Google Cloud CDN and Bucket backend

阅读更多关于 Custom HTTP headers with Google Cloud CDN and Bucket backend

问题 How can I send custom HTTP headers with a bucket backend for Cloud CDN without the x-goog-meta- prefix? In particular, I'm trying to send a Content-Security-Policy header, which turns into x-goog-meta-Content-Security-Policy and thus is ignored by the browser. Screenshot: Google Storage/ Bucket Meta data UI Screenshot: Response headers 来源： https://stackoverflow.com/questions/43853564/custom-http-headers-with-google-cloud-cdn-and-bucket-backend

How does Content-Security-Policy work with X-Frame-Options?

阅读更多关于 How does Content-Security-Policy work with X-Frame-Options?

问题 Does Content-Security-Policy ignore X-Frame-Options , returned by a server, or is X-Frame-Options still primary? Assuming that I have: a website http://a.com with X-Frame-Options: DENY and a website http://b.com with Content-Security-Policy: frame-src a.com will browser load this frame? It is unclear. On the one hand, http://a.com explicitly denies framing. On the other hand, http://b.com explicitly allows framing for http://a.com. 回答1: The frame-src CSP directive (which is deprecated and

Iframe in Chrome error: Failed to read 'localStorage' from 'Window': Access denied for this document

阅读更多关于 Iframe in Chrome error: Failed to read 'localStorage' from 'Window': Access denied for this document

问题 I have a web app which uses localStorage. Now we want to embed this web app on other (third-party) sites via iframe. We want to provide an iframe embed similar to youtube so that other websites can embed our web app in an iframe. Functionally it is the same as if it wouldn't be embedded. But it does not work. Chrome prints the error message: Uncaught SecurityError: Failed to read the 'localStorage' property from 'Window': Access is denied for this document. I just do the following check (in

browser-sync is blocked by chrome csp

阅读更多关于 browser-sync is blocked by chrome csp

I have a gulp task that runs browsersync. var options = { proxy : 'localhost:9000/html' , port : 3000 , files : [ config.root + config.srcPaths.htmlBundle , config.htmlRoot + 'main.css' , '!' + config.htmlRoot + '**/*.scss' ] , injectChanges : false , logFileChanges : true , logPrefix : 'broserSync ->' , notify : true , reloadDelay : 1000 }; browserSync( options ); browsersync detects changes and tries to inject them but chrome blocks it with this error: Refused to connect to 'ws://localhost:3000/browser-sync/socket.io/?EIO=3&transport=websocket&sid=gOQQPSAc3RBJD2onAAAA' because it violates

“[Report Only] Refused to load the font…” error message on console

阅读更多关于 “[Report Only] Refused to load the font…” error message on console

问题 More specifically: [Report Only] Refused to load the font 'data:application/x-font-woff;charset=utf-8;base64,d09GRgABAAAAABBQAAoAAAAAG…H8zVsjnmMx0GcZ2HGViNOySWEa9fvEQtW43Nm+EOO0ZIpdLbMXoVzPJkcfHT6U+gLEpz/MAAAA' because it violates the following Content Security Policy directive: "font-src 'self'". this is my contentSecurityPolicy object at environment.js : contentSecurityPolicy: { 'default-src': "'none'", 'script-src': "'self' 'unsafe-inline' 'unsafe-eval' connect.facebook.net", 'connect-src'

How to define Content-Security-Policy in Cordova properly?

阅读更多关于 How to define Content-Security-Policy in Cordova properly?

I am struggling for some days already with defining my Content-Security-Policy for my Cordova App. My first question is: Do I have to add CSP in Cordova? It seems like Cordova adds meta tag for CSP by default and add Whitelist plugin, requiring to define your CSP for every page. If I have to define: How to properly define directives for my need: I am adding some js files, css files, and have inline js code, as well as styles. I have added this CSP for my page. And it is complaining about style-src . <meta http-equiv="Content-Security-Policy" content="default-src *; script-src 'self' 'nonce