News for hackers. Stuff that matters.
Re:Content Security Policy by ushi on Friday April 19, 2013 @11:49AM (#5577252)
> it's useful for when hosting statically.

You can configure your webserver to add those headers, when hosting statically. There is no need to include it in all your pages.

nginx: add_header Content-Security-Policy "...";

Re:Content Security Policy by joshpeek on Friday April 19, 2013 @11:53AM (#5577273)
If your site is a simple static blog or whatever, there probably is no XSS vector. So you probably don't need CSP.