Questions tagged [content-security-policy]

Use to tag questions about Content Security Policy, either using the header or meta tag variants

Filter by
Sorted by
Tagged with
0 votes
1 answer
2k views

nginx Content-Security-Policy headers: why do they have to be all on the same line? (version 1.18 vs 1.22)

I have two different servers, one using nginx 1.18 and another using 1.22. The headers on the 1.18 version are: add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; ...
ehtio's user avatar
  • 103
2 votes
1 answer
2k views

Content Security Policy error when trying to share images from Google Drive on my website

I'm using Google Drive to upload my images, so my images' URL in my website are like this: <img src="https://drive.google.com/uc?export=view&id=1SJcEZndPKl7DxU1K8Iit" /> In my ...
Ömer Faruk Demirel's user avatar
2 votes
1 answer
37 views

Is there any problem with moving GA4 tracking code to a file on my own domain, and updating the file contents daily?

I have a site that I intentionally set up with a very strict CSP, such that inline scripts won't work. Additionally, any 3rd party scripts require a subresource integrity hash, to ensure the 3rd party ...
Jake 1986's user avatar
  • 853
2 votes
0 answers
424 views

Allow Content Security Policy For Iframe With data:text/html

I'm trying to use iframe with data:text/html. My iframe tag is: <iframe id="preview" class="preview" src="data:text/html;charset=utf-8,%3Cscript%20src%3D%22https%3A//cdnjs....
Ömer Faruk Demirel's user avatar
1 vote
1 answer
359 views

I have the bulk of my CSP policy in .htaccess. How do I add to it in the HTML page header?

My relevant CSP in .htaccess is Header always set Content-Security-Policy "upgrade-insecure-requests; \ default-src 'self'; \ img-src https: data:; \ object-src 'none'; \ script-src 'self'...
Rohit Gupta's user avatar
  • 2,462
5 votes
1 answer
279 views

CSP added but Lighthouse flags it as missing

Ive added a CSP via PHP but Lighthouse is still saying 'Ensure CSP is effective against XSS attacks' Heres my CSP, is there something missing or set incorrectly that could be causing Lighthouse to ...
user3914769's user avatar
1 vote
0 answers
34 views

Patent warning for using nonce feature of Content-Security-Policy

Just asking if anyone has come across something like this and I'm really not sure what part of stackexchange this really fits in... I'm not going to post details of the company or patent information, ...
USD Matt's user avatar
  • 111
1 vote
0 answers
58 views

Is it safe to delete crossdomain.xml now that Flash is no longer supported

A website I have contributed to has a crossdomain.xml file live. Through my personal Googling it seems that this file is related exclusively related to cross domain permissions for Adobe Flash. As ...
Rhys Mills's user avatar
0 votes
1 answer
27 views

Wordpress: console errors from web sites I have linked to

On this one page of my site, https://litchfieldmagazine.com/litchfield-county-design-resource-guide/ I have hundreds of console errors that are coming from sites I have linked to in the posts ...
Steve's user avatar
  • 111
1 vote
0 answers
53 views

Chrome gives a content-security-policy warning when viewing an image in its own tab on my site

I'm setting Content-Security-Policy in htaccess. I use a pretty basic and strict policy: Header always set Content-Security-Policy "default-src 'self'; script-src 'self' http: https: *.googleapis....
mowgli's user avatar
  • 312
2 votes
0 answers
345 views

Generating the base64 of sha256 of a file for Content Security Policy of a web page

The issue I have a small private Apache2 web server running on Debian 10 Buster with security on my top list. Right now, I'm struggling with: How to generate in the Linux terminal the base64-encoded ...
Vlastimil Burián's user avatar
2 votes
0 answers
279 views

Do Content-Security-Policy errors affect SEO rankings?

There is a website that allows users to post content and embed images from external links. This website has a Content-Security-Policy that allows only a small list of other websites in img-src. If a ...
user3757605's user avatar
1 vote
1 answer
71 views

Missing "policy" stated by Yahoo since DMARC implementation?

Since the implementation of DMARC on our server we get feedback reports from Yahoo, stating we do not publish a "policy" which therefore cannot be evaluated (to my understanding). However the same ...
Erich's user avatar
  • 11
1 vote
2 answers
126 views

Should I be concerned that Google Ads sometimes shows Passive mixed content (insecure images) in some Ads?

In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content: Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure image ...
JAT86's user avatar
  • 205
4 votes
0 answers
2k views

Does Content Security Policy (CSP) affect Google ranking? Pagespeed scores are worse without unsafe-inline

I introduced Content Security Policy (CSP) in a website, nonetheless some of its commands and implications seem to negatively affect Google Page Speed Insights ranking. That happens in certain CSP ...
João Pimentel Ferreira's user avatar
2 votes
2 answers
2k views

Prevent sending referrers when clicking links from my site with an exception for one domain

Let's admit that, for security / privacy reasons, I want to globally set my referrer policy to be "no-referrer". For instance, using Apache's .htaccess's Header always set Referrer-Policy no-...
Clément's user avatar
2 votes
1 answer
2k views

defer img loading / CSP: allow embeded img

My website is defering some img loading by setting the img src value by JavaScript (from the img data-src value). In order to have still valid HTML as long as the URL is not set to img src, I am ...
Marcus's user avatar
  • 165