3 ms·
You can also specify a CSP using a document's meta tags: <meta http-equiv="Content-Security-Policy" content="default-src *; script-src https://assets.example
by pfraze 14y ago
You can also specify a CSP using a document's meta tags:
<meta http-equiv="Content-Security-Policy" content="default-src *; script-src https://assets.example.com; style-src https://assets.example.com"></meta>
I'm not sure if that introduces any additional attack vectors (other than somebody modifying the document in an unencrypted connection) but it's useful for when hosting statically.
EDIT: updated to mimic example in post
- ushi 14y ago> it's useful for when hosting statically. You can configure your webserver to add those headers, when hosting statically. There is no need to include it in all your pages. nginx: add_header Content-Security-Policy "...";
- joshpeek 14y agoIf your site is a simple static blog or whatever, there probably is no XSS vector. So you probably don't need CSP.