Skip to content

Latest commit

 

History

History
37 lines (27 loc) · 2.75 KB

CSP_Defense.md

File metadata and controls

37 lines (27 loc) · 2.75 KB

  1. Adding policies through meta tags: The preferred setting method for CSP is the HTTP header, which is very useful, but it is more straightforward to set through tags or scripts. WebKit has implemented the feature of setting permissions through meta elements , so you can now try the following settings in Chrome: add <metahttp-equiv = "X-WebKit-CSP" content = "[POLICY GOES HERE]" in the header of the document >.

  2. DOM API: If this feature is added in the next iteration of CSP, you can query the current security policy of the page through Javascript and adjust it according to different situations. For example, if eval () is available, your code implementation may be slightly different.

Content security policy applies to all common resources

  1. content-src: limit the type of connection (such as XHR, WebSockets, and EventSource)
  2. font-src: Controls the source of web fonts. For example, you can use Google's web fonts through font-src
  3. img-src: defines the source of the loadable image.
  4. media-src: Restrict video and audio sources.
  5. object-src: Restrict sources of Flash and other plugins.
  6. style-src: Similar to Script-src, but only works on css files.

Under the CSP 1 specification, you can also set the following rules:

img-src Valid image source
connect-src Apply to XMLHttpRequest (AJAX), WebSocket or EventSource
font-src Valid font source
object-src Effective plug-in source (eg, , , )
media-src Valid and