3 ms·
Could you not simplify your large CSP header by using wildcards and moving some of your dependencies to a central place (e.g. host Font Awesome yourself)?
by seanwilson 10y ago
Could you not simplify your large CSP header by using wildcards and moving some of your dependencies to a central place (e.g. host Font Awesome yourself)?
- aidantwoods 10y agoIt can be simplified, but it would reduce its usefulness to include wild cards. By specifying paths more explicitly, I whitelist less of the domain (and consequently reduce the chances that I'll whitelist something this is user controllable in the domain). I'll usually try to allow down to specific files in CSP if I can. Hosting font awesome myself costs me money, pointing to cloudflare is free Edit: check out my site vs. a few others using Google's CSP evaluator – you'll probably find a lot with known CSP bypasses due to their whitelisting.