How to utilize content security policy level 3 efficiently on your website

Question

Creator

Topic
August 8, 2020 at 12:18 am #2142289

How to utilize content security policy level 3 efficiently on your website

by naj7riyami · about 2 years, 7 months ago

Tags: Security, Security

How to utilize content security policy level 3 efficiently on your website Without any error on google console
Creator

Topic

Answer This

All Answers

Author

Replies
- August 12, 2020 at 6:20 am #2418448
 
 How to utilize content security policy level 3 efficiently on your website
 
 by deborasumopayroll · about 2 years, 7 months ago
 
 In reply to How to utilize content security policy level 3 efficiently on your website
 
 With this policy defined, the browser simply throws an error instead of loading script from any other source. When a clever attacker manages to inject code into your site, they’ll run headlong into an error message rather than the success they were expecting.
 
 Policy applies to a wide variety of resources
 While script resources are the most obvious security risks, CSP provides a rich set of policy directives that enable fairly granular control over the resources that a page is allowed to load. You’ve already seen script-src, so the concept should be clear.
 
 Let’s quickly walk through the rest of the resource directives. The list below represents the state of the directives as of level 2. A level 3 spec has been published, but is largely unimplemented in the major browsers.
 
 base-uri restricts the URLs that can appear in a page’s element.
 child-src lists the URLs for workers and embedded frame contents. For example: child-src https://youtube.com would enable embedding videos from YouTube but not from other origins.
 connect-src limits the origins that you can connect to (via XHR, WebSockets, and EventSource).
 font-src specifies the origins that can serve web fonts. Google’s web fonts could be enabled via font-src https://themes.googleusercontent.com.
 form-action lists valid endpoints for submission from
 
 tags.
 frame-ancestors specifies the sources that can embed the current page. This directive applies to , , <embed />, and <applet> tags. This directive can’t be used in <meta /> tags and applies only to non-HTML resources. frame-src was deprecated in level 2, but is restored in level 3. If not present it still falls back to child-src as before. img-src defines the origins from which images can be loaded. media-src restricts the origins allowed to deliver video and audio. object-src allows control over Flash and other plugins. plugin-types limits the kinds of plugins a page may invoke. report-uri specifies a URL where a browser will send reports when a content security policy is violated. This directive can’t be used in <meta /> tags. style-src is script-src’s counterpart for stylesheets. upgrade-insecure-requests instructs user agents to rewrite URL schemes, changing HTTP to HTTPS. This directive is for websites with large numbers of old URL’s that need to be rewritten. worker-src is a CSP Level 3 directive that restricts the URLs that may be loaded as a worker, shared worker, or service worker. As of July 2017, this directive has li</applet>
Author

Replies

Viewing 0 reply threads

Start or Search

Start New Discussion

PURPOSE These guidelines from TechRepublic Premium will help you define the necessary ingredients of a security policy and assist in its proper construction. They’re designed to work hand in hand with the subjective knowledge you have of your company, environment and employees. Using this information, your business can establish new policies or elaborate on those ...

PURPOSE Recruiting an Artificial Intelligence Architect with the right combination of technical expertise and experience will require a comprehensive screening process. This Hiring Kit from TechRepublic Premium provides an adjustable framework your business can use to find, recruit and ultimately hire the right person for the job. From the hiring kit: DETERMINING FACTORS, DESIRABLE PERSONALITY ...

PURPOSE Hiring the right Autonomous Systems Engineer requires a specific and precise recruitment process, supported by a thorough understanding of the project requirements. This Hiring Kit from TechRepublic Premium provides an adjustable framework your business can use to find, recruit and ultimately hire the right person for the job. From the hiring kit: DETERMINING FACTORS, ...

Web Development

Question