News for hackers. Stuff that matters.

A comment on Content Security Policy.

Re:Content Security Policy by pfraze on Friday April 19, 2013 @10:45AM (#5576901)
You can also specify a CSP using a document's meta tags:

  <meta http-equiv="Content-Security-Policy" content="default-src *; script-src https://assets.example.com; style-src https://assets.example.com"></meta>
I'm not sure if that introduces any additional attack vectors (other than somebody modifying the document in an unencrypted connection) but it's useful for when hosting statically.

EDIT: updated to mimic example in post

[ Parent | on HN ]
Re:Content Security Policy by ushi on Friday April 19, 2013 @11:49AM (#5577252)
> it's useful for when hosting statically.

You can configure your webserver to add those headers, when hosting statically. There is no need to include it in all your pages.

nginx: add_header Content-Security-Policy "...";

[ Parent | on HN ]
Re:Content Security Policy by joshpeek on Friday April 19, 2013 @11:53AM (#5577273)
If your site is a simple static blog or whatever, there probably is no XSS vector. So you probably don't need CSP.
[ Parent | on HN ]