content-security-policy

What is happening when I have two CSP (Content Security Policies) policies - header & meta?

阅读更多关于 What is happening when I have two CSP (Content Security Policies) policies - header & meta?

Question is regarding having CSP served twice: What's the behavior if there is one policy served through the Content-Security-Policy HTTP response header and also another policy specified with the <meta /> element? Will those two be merged somehow? Or else which one has priority? (I cannot find clear info on this in the spec). Specific use case might be serving Report-to through the HTTP response header and putting all other restrictions in the <meta /> element — because some of those are generated by webpack - and if I shouldn't be worried about <meta /> shallowed by the HTTP response-header

Get JSON in a Chrome extension

阅读更多关于 Get JSON in a Chrome extension

Small problem with my chrome extension. I just wanted to get a JSON array from another server. But manifest 2 doesn't allow me to do it. I tried specify content_security_policy , but the JSON array is stored on a server without SSL cert. So, what should I do without using manifest 1? The CSP cannot cause the problem you've described. It's very likely that you're using JSONP instead of plain JSON. JSONP does not work in Chrome, because JSONP works by inserting a <script> tag in the document, whose src attribute is set to the URL of the webservice. This is disallowed by the CSP . Provided that

Chrome Extension - Content Security Policy - executing inline code

阅读更多关于 Chrome Extension - Content Security Policy - executing inline code

问题 I am using an external JavaScript lib in my chrome extension. I has inline execution, so I get following kind of error (The error I get on console) Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension://". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. The error message clearly says there is a work-around possible. Chrome-Content

Jenkins Content Security Policy

阅读更多关于 Jenkins Content Security Policy

问题 I'm confused about Jenkins Content Security Policy. I know these sites: Configuring Content Security Policy Content Security Policy Reference I have a html page shown via Jenkins Clover Plugin. This html page uses inline style, e.g.: <div class='greenbar' style='width:58px'> The div-element visualizes a progressbar. Using the default Jenkins CSP configuration leads to the following result: Progressbar_FAIL The result i want to have looks like this: Progressbar_WORKS I tried to relax the CSP

How to use frame-src and child-src in Firefox and other browsers?

阅读更多关于 How to use frame-src and child-src in Firefox and other browsers?

问题 The MDN page on Content Security Policy directives states the frame-src is deprecated and child-src should be used. However, Firefox 37 gives the following error message when I attempt to use child-src Content Security Policy: Couldn't process unknown directive 'child-src' <unknown> This apparent lack of support isn't documented (as far as I could tell) which is frustrating. Is there any place browser support is documented? Currently I'm using frame-src in addition to child-src, which appears

Banned inline style CSP and dynamic positioning of HTML elements

阅读更多关于 Banned inline style CSP and dynamic positioning of HTML elements

问题 A client has changed their CSP to ban inline styles on their server. As far as I can tell, this means that we can no longer use JS to dynamically position/animate/style HTML elements e.g. we can't detect the position of a DOM element and position another element next to it via JS. Is this correct? Is there a workaround for us to dynamically animate DOM elements with this CSP restriction in place? 回答1: JavaScript is executed on the client. Unless the filtering software is incredibly clever,

Chrome extension Content Security Policy directive error

阅读更多关于 Chrome extension Content Security Policy directive error

问题 I'm trying to make radio stream chrome extension but there is a problem. When I run my script in browser like normal JS+HTML+CSS it works, but when I try runing it like Chrome extension I get this error: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. After that I added

Content-Security-Policy error in google chrome extension making

阅读更多关于 Content-Security-Policy error in google chrome extension making

I am making a chrome extension that will open all links on a page in new tabs. Here are my code files: manifest.json { "name": "A browser action which changes its icon when clicked.", "version": "1.1", "permissions": [ "tabs", "<all_urls>" ], "browser_action": { "default_title": "links", // optional; shown in tooltip "default_popup": "popup.html" // optional }, "content_scripts": [ { "matches": [ "<all_urls>" ], "js": ["background.js"] } ], "manifest_version": 2 } popup.html <!doctype html> <html> <head> <title>My Awesome Popup!</title> <script> function getPageandSelectedTextIndex() { chrome

Can Content Security Policy be made compatible with Google Analytics and AdSense?

阅读更多关于 Can Content Security Policy be made compatible with Google Analytics and AdSense?

问题 Does anyone know how to get CSP, even with the default-src wildcard, to work so a modern Analytics script sends website per-page data (not just home page data) to the site owner's account and so AdSense ads appear? I tried many variations of CSP for my website, including that proposed in <H5BP.com>'s .htaccess file, but all blocked Google Analytics from producing per-page data (except for the home page) and Google AdSense from accepting ads on any page. Google's machines did not see the

Google Adwords CSP (content security policy) img-src

阅读更多关于 Google Adwords CSP (content security policy) img-src

问题 What domains/protocols in the img-src directive of the Content-Security-Policy header are required to allow Google AdWords conversion tracking? From testing, when we call google_trackConversion , it looks like the browser creates an image with a src that follows a chain of 302 redirects between various domains... www.googleadservices.com -> googleads.g.doubleclick.net -> www.google.com -> www.google.co.uk The final .co.uk looks suspicious to me. As we're testing from the UK, we're concerned