Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to secure my website using a Content Security Policy. I'm came up with the following policy:

X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; script-src https://ajax.googleapis.com

I have two questions regrding the Content Security Policy I want to set.

  1. I use Google's CDN only to get the jQuery library. Is it possible to make a policy that only allows certain scripts to load from a domain instead of the generic script-src?
  2. Is my policy correct? E.g. having two domains for the default-src and a separate one for script-src. Will I still be able to server script-src files through my own domains?
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

For Q1: No. In the W3C spec it says that script-src specifies hosts as follows:

( [ scheme "://" ] host [ port ] )

so nothing after the host or port can be used.

For Q2: From my reading of the spec, yes, it's correct.

If not specified explicitly in the policy, the directives listed above will use the default sources.

So you have two domains as defaults for everything, and then you further refine script-src with a particular domain. However if you want to serve script-src files from your own domain then you'll need to add your domain after ajax.googleapis.com.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.