3 ms·
For some reason I believed that CSP rules can be hostnames but not paths. At least in Mozialla's documentation above there is not a single example of a rule wit
by jakobdabo 9y ago
For some reason I believed that CSP rules can be hostnames but not paths. At least in Mozialla's documentation above there is not a single example of a rule with a full path. I can't check it by myself right now to find out the truth as I'm far away from my development PC.
- mrkurt 9y agoAh, Mozilla's docs are not great. The spec allows a URI, and there is guidance on how to interpret paths: https://www.w3.org/TR/CSP2/#source-list-path-patching https://www.w3.org/TR/CSP2/#source-list-path-patching
- lvh 9y agoAccording to the CSP2 spec, the value of a -src directive contains three parts: - protocol/scheme (optional) - hostname (mandatory) - path (optional) Notably, there is no query portion or fragment portion; browsers are expected to ignore those. Path matching works like a prefix if it ends in a slash. If it doesn't, only exactly that path matches. In CSP3, the secure protocol/scheme (https, wss) always matches, even if you explicitly specify http:// http://. In CSP2, the implicit scheme matches either; an explicit scheme only matches that scheme. This is typically not useful behavior because you probably have HSTS anyway, so people just use hostnames and only rarely specify the protocol. Most values in practice seem to just be hostnames in general; paths too are rare.
- jakobdabo 9y agoThank you, that was insightful.