I want to secure my website using a Content Security Policy. I'm came up with the following policy:
X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; script-src https://ajax.googleapis.com
I have two questions regrding the Content Security Policy I want to set.
- I use Google's CDN only to get the jQuery library. Is it possible to make a policy that only allows certain scripts to load from a domain instead of the generic
- Is my policy correct? E.g. having two domains for the
default-srcand a separate one for
script-src. Will I still be able to server
script-srcfiles through my own domains?