Programming Tutorials

(追記) (追記ここまで)

Content-Security-Policy: object-src, script-src, base-uri and report-uri

By: Niraj in WebServices Tutorials on 2023年03月29日 [フレーム]

The Content-Security-Policy (CSP) header you provided sets several security policies for your website. Here's a breakdown of what each directive does:

  • object-src 'none';: This directive specifies that no content from any other origin can be embedded as an object within your website.

  • script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;: This directive specifies where scripts can be loaded from on your website.

    • 'nonce-{random}': This allows scripts to be loaded from inline script elements that contain a randomly generated nonce attribute. This helps to mitigate against certain types of cross-site scripting (XSS) attacks.

    • 'unsafe-inline': This allows inline scripts to be executed. Inline scripts are generally discouraged as they can introduce security vulnerabilities.

    • 'unsafe-eval': This allows the use of eval() and new Function() for script execution on your website. As mentioned earlier, this can introduce security vulnerabilities and should be used with caution.

    • 'strict-dynamic': This allows scripts to be loaded dynamically at runtime using trusted functions. This helps to mitigate against certain types of XSS attacks.

    • https: http:;: This specifies that scripts can be loaded from any https or http source. However, it's generally recommended to only allow scripts to be loaded from trusted sources over https.

  • base-uri 'none';: This directive specifies that no URLs can be used as the base URL for resolving relative URLs. This helps to prevent certain types of injection attacks.

  • report-uri https://your-report-collector.example.com/: This directive specifies the URL to which a violation report is sent if a policy is violated. This can be used to track and investigate security issues on your website.

Overall, this CSP header helps to enforce a number of security policies on your website, but it's important to ensure that the policies are tailored to your website's specific needs and that you are regularly reviewing and updating them as necessary.




(追記) (追記ここまで)


Add Comment

JavaScript must be enabled for certain features to work
* Required information
1000

Comments

No comments yet. Be the first!

Most Viewed Articles (in WebServices )

Latest Articles (in WebServices)

(追記) (追記ここまで)
(追記) (追記ここまで)

AltStyle によって変換されたページ (->オリジナル) /