24 ms·

Then you need to detect CDN's that actually serve your content. Images and such. They can also come from your subdomain(s) of course. Maybe you could whitelist

Then you need to detect CDN's that actually serve your content. Images and such. They can also come from your subdomain(s) of course. Maybe you could whitelist the subdomains only.

nailer 11y ago
> Maybe you could whitelist the subdomains only. https://www.npmjs.com/package/csp-by-api https://www.npmjs.com/package/csp-by-api can help with that: it contains CSPs for popular APIs so you can just add the the APIs you're using to your own CSP: var policy = cspByAPI(basePolicy, ['twitter', 'mixpanel', 'googleFonts', 'stripe', 'typekit', 'ractive'])