ubuntu:csp_content_security_policy
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| ubuntu:csp_content_security_policy [2020/04/15 08:33] – peter | ubuntu:csp_content_security_policy [2023/06/04 11:30] (current) – peter | ||
|---|---|---|---|
| Line 7: | Line 7: | ||
| **NOTE**: It is known that having both **Content-Security-Policy** and **X-Content-Security-Policy** or **X-Webkit-CSP** causes unexpected behaviours on certain versions of browsers. | **NOTE**: It is known that having both **Content-Security-Policy** and **X-Content-Security-Policy** or **X-Webkit-CSP** causes unexpected behaviours on certain versions of browsers. | ||
| </ | </ | ||
| + | |||
| + | ---- | ||
| ===== Directive Reference ===== | ===== Directive Reference ===== | ||
| Line 29: | Line 31: | ||
| |plugin-types|application/ | |plugin-types|application/ | ||
| |base-uri| |Restricts the URLs that can be used to specify the document base URL.| | |base-uri| |Restricts the URLs that can be used to specify the document base URL.| | ||
| + | |||
| + | ---- | ||
| ===== Source List Reference ===== | ===== Source List Reference ===== | ||
| Line 48: | Line 52: | ||
| |' | |' | ||
| + | ---- | ||
| ===== How it Works ===== | ===== How it Works ===== | ||
| Line 59: | Line 64: | ||
| * **none** indicates that nothing should be loaded for a given directive e.g. object-src ' | * **none** indicates that nothing should be loaded for a given directive e.g. object-src ' | ||
| + | ---- | ||
| ===== Content-Security-Policy Examples ===== | ===== Content-Security-Policy Examples ===== | ||
| Line 72: | Line 78: | ||
| </ | </ | ||
| + | ---- | ||
| ==== Only Allow Scripts from the same origin ==== | ==== Only Allow Scripts from the same origin ==== | ||
| Line 79: | Line 86: | ||
| </ | </ | ||
| + | ---- | ||
| ==== Allow Same Origin, Google Analytics, and Google AJAX CDN ==== | ==== Allow Same Origin, Google Analytics, and Google AJAX CDN ==== | ||
| Line 86: | Line 94: | ||
| </ | </ | ||
| + | ---- | ||
| ==== Starter Policy ==== | ==== Starter Policy ==== | ||
| Line 95: | Line 104: | ||
| </ | </ | ||
| + | ---- | ||
| ==== Mixed Content Policy ==== | ==== Mixed Content Policy ==== | ||
| Line 122: | Line 132: | ||
| </ | </ | ||
| + | ---- | ||
| ===== Prevent Clickjacking ===== | ===== Prevent Clickjacking ===== | ||
| Line 161: | Line 172: | ||
| </ | </ | ||
| + | ---- | ||
| ===== Re-factoring inline code ===== | ===== Re-factoring inline code ===== | ||
| Line 233: | Line 245: | ||
| </ | </ | ||
| + | ---- | ||
| ===== Content-Security-Policy Error Messages ===== | ===== Content-Security-Policy Error Messages ===== | ||
| Line 248: | Line 261: | ||
| </ | </ | ||
| + | |||
| + | ---- | ||
| ===== Server Side Configuration ===== | ===== Server Side Configuration ===== | ||
| Line 260: | Line 275: | ||
| Header set Content-Security-Policy " | Header set Content-Security-Policy " | ||
| </ | </ | ||
| + | |||
| + | ---- | ||
| ==== Nginx Content-Security-Policy Header ==== | ==== Nginx Content-Security-Policy Header ==== | ||
| Line 271: | Line 288: | ||
| You can also append **always** to the end to ensure that nginx sends the header reguardless of response code. | You can also append **always** to the end to ensure that nginx sends the header reguardless of response code. | ||
| + | ---- | ||
| ==== IIS Content-Security-Policy Header ==== | ==== IIS Content-Security-Policy Header ==== | ||
| Line 286: | Line 304: | ||
| </ | </ | ||
| + | ---- | ||
| ===== Other Examples of CSP ===== | ===== Other Examples of CSP ===== | ||
| Line 301: | Line 320: | ||
| Note how Facebook makes use of wildcards for both subdomains, as well as port numbers in connect-src. | Note how Facebook makes use of wildcards for both subdomains, as well as port numbers in connect-src. | ||
| + | |||
| + | ---- | ||
| ==== Twitter ==== | ==== Twitter ==== | ||
| Line 322: | Line 343: | ||
| Notice how the directives all contain https:, thus enforcing SSL. | Notice how the directives all contain https:, thus enforcing SSL. | ||
| + | ---- | ||
| ===== Capturing CSP Violations with report-uri ===== | ===== Capturing CSP Violations with report-uri ===== | ||
| Line 350: | Line 372: | ||
| </ | </ | ||
| + | ---- | ||
| ===== Content-Security-Policy-Report-Only ===== | ===== Content-Security-Policy-Report-Only ===== | ||
| Line 355: | Line 378: | ||
| If you're thinking of implementing CSP, you can take your CSP for a dry run by using the **Content-Security-Policy-Report-Only** HTTP header instead of **Content-Security-Policy**. | If you're thinking of implementing CSP, you can take your CSP for a dry run by using the **Content-Security-Policy-Report-Only** HTTP header instead of **Content-Security-Policy**. | ||
| + | ---- | ||
| ===== Test ===== | ===== Test ===== | ||
| Line 362: | Line 386: | ||
| https:// | https:// | ||
| + | ---- | ||
| ===== References ===== | ===== References ===== | ||
ubuntu/csp_content_security_policy.1586939600.txt.gz · Last modified: 2020/07/15 09:30 (external edit)