4 ms·
This is possible with the Content Security Policy header, including automated reports from the browsers when things are blocked. It's hard to implement however
by Ambroos 10y ago
This is possible with the Content Security Policy header, including automated reports from the browsers when things are blocked. It's hard to implement however since a whitelist of allowed domains can grow very, very large for the average site.
- nailer 10y ago> It's hard to implement however since a whitelist of allowed domains can grow very, very large for the average site. Exactly. I made a library for that: https://www.npmjs.com/package/csp-by-api https://www.npmjs.com/package/csp-by-api Eg if your web app uses embedded Tweets, MixPanel, and GoogleFonts: var policy = cspByAPI(basePolicy, ['twitter', 'mixpanel', 'googleFonts' ]); Ie, the package maintains an up to date list of the image, script, etc sources for all those different embeds, so you only have to specify what your own code needs (that's the basePolicy). It's for node, but you can easily port it to Elixir or Python or Ruby. Policies for 16 common CSP embeds are included, please send a pull request to add more.