2 ms·
Setting a CSP header can be simple but managing changes to it can get difficult. Especially as team members add or remove services from the app (Intercom, Googl
by zinssmeister 9y ago
Setting a CSP header can be simple but managing changes to it can get difficult. Especially as team members add or remove services from the app (Intercom, Google Analytics, etc.)
We also provide a reporting endpoint that captures all violations. Do you currently use a CSP header with a report-uri setting?
- Eridrus 9y agoHave you actually found much value from these reports? Most people I talk to tell me they're full of garbage.
- zinssmeister 9y agoNoise is a problem and we are in this fight to improve exactly that.
- Eridrus 9y agoThere is clearly noise, but is there any signal at all? I wouldn't be surprised if there was no signal to be found.
- zinssmeister 9y agoThere is a lot more signal than noise, especially they way we aggregate the security reports. CSP can be deployed in report only mode, which provides a great way to detect how your policy has to come together.
- Eridrus 9y agoI guess in my mind signal == attacks, but I guess there's also value in having reports when your policy broke things if you don't have other methods for detecting that, or if your integration tests disable CSP.
- Alex3917 9y agoAhh that makes sense. We have an API-driven SPA, so our API is just banned from returning anything fun. But I can see how this becomes an for apps with server-side rendering based on how annoying it is to manage the CSP on our front end.