3 ms·
Doesn't a CSP catch and report mixed content issues?
by finnn 10y ago
Doesn't a CSP catch and report mixed content issues?
- seanhunter 10y agoA csp can say that you only want to load things over https and Strict-transport security (HSTS) also helps here (see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ). I've found http://securityheaders.io http://securityheaders.io quite helpful in securing my servers alongside ssl labs server test (as others have mentioned) to check that your actual server and SSL certs are configured well.
- finnn 10y agoAccording [0] CSP can do it and offers reporting, unlike HSTS. [0]: https://scotthelme.co.uk/fixing-mixed-content-with-csp/ https://scotthelme.co.uk/fixing-mixed-content-with-csp/
- jusob 10y agoCSP is not supported by IE, unfortuantely. But you an do 2 things around HTTPS: * set up a report-only policy saying taht all assets must be loaded over HTTPS. You can receive a report when this is not the case. * use upgrade-insecure-requests to upgrade HTTP requests to HTTPS automatically. Obviously, this can break stuff if the 3rd party server does not supprot HTTPS or has invalid SS certificates (CDN, for example). Most browsers load images over HTTP from a HTTPS site but they will not for active content (Javascript, IFRAMES, etc.) unless the user explicitly acknowledge the mixed-content issue.