CSP from pentests #4123
CSP from pentests #4123
Conversation
netlify.toml
Outdated
| [[headers]] | ||
| for = "/*" | ||
| [headers.values] | ||
| Content-Security-Policy = "default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data: blob:; frame-ancestors *" | ||
| Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src https:; img-src https: data: blob:; frame-ancestors *; object-src 'none'; connect-src https:; require-trusted-types-for 'script'" |
There was a problem hiding this comment.
From the SvelteKit docs:
There was a problem hiding this comment.
Is thr a way to generate nonce for the script-src, style 'unsafe-inline' can work.
There was a problem hiding this comment.
Given we're building a static site, we should use hashes not nonces. Leaving the blog post I shared with you here for us to come back to later: https://dev.to/askrodney/sveltekit-content-security-policy-csp-for-xss-protection-589k
| Cross-Origin-Embedder-Policy = "credentialless" | ||
| Cross-Origin-Opener-Policy = "unsafe-none" | ||
| Cross-Origin-Resource-Policy = "cross-origin" | ||
| X-Frame-Options = "allow-from *" |
There was a problem hiding this comment.
Do we need this X-Frame-Options? This ChatGPT convo implies allow-from doesn't support wildcards and the Mozilla docs say the allow-from directive is deprecated.
There was a problem hiding this comment.
yeah, but somehow https://securityheaders.com/?q=ui.rilldata.in&followRedirects=on gives it a green :P
| @@ -2,7 +2,11 @@ | |||
| [[headers]] | |||
| for = "/*" | |||
| [headers.values] | |||
| Content-Security-Policy = "default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data: blob:; frame-ancestors *" | |||
| Content-Security-Policy = "default-src 'self'; script-src 'self' https: 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data: blob:; frame-src data:; frame-ancestors *; object-src 'none'; connect-src https:;" | |||
There was a problem hiding this comment.
What's the point of frame-src data:;? What iframe is that meant to accommodate? ChatGPT called it out as being uncommon:
There was a problem hiding this comment.
Was getting Refused to frame '' because it violates the following Content Security Policy directive
https://serverfault.com/questions/945834/refused-to-frame-because-it-violates-the-following-content-security-policy-di suggested data: and it worked!
No description provided.