RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 5 of 7
Safety · Mar 28, 2023
CSP style-src vs unsafe-inline for public sites is how you allow first-party CSS without inviting injected style tags. style-src lists which stylesheets and inline style blocks may apply. 'unsafe-inline' lets any inline…
Read guide →Safety · Mar 20, 2023
CSP strict-dynamic vs nonce host allowlists is two ways to trust scripts after you already have a nonce or hash: the nonce marks the tags you meant to run, a host list allows every file on that origin, and…
Read guide →Safety · Mar 11, 2023
CSP script-src-elem vs script-src for public sites is a split allowlist versus the combined one. script-src-elem governs <script> elements (src and inline script blocks). script-src-attr governs event-handler attributes…
Read guide →Safety · Mar 3, 2023
CSP sandbox vs iframe sandbox for public pages is two places the same idea can live. The sandbox attribute on your <iframe> limits what that child document may do. The CSP sandbox directive applies sandbox flags to the…
Read guide →Safety · Feb 22, 2023
CSP require-sri-for vs Integrity-Policy for CDN scripts is two ways to demand Subresource Integrity — one of them is a CSP leftover. require-sri-for was a Content-Security-Policy directive that asked supporting browsers…
Read guide →Safety · Feb 14, 2023
CSP report-uri vs Report-To is how violation telemetry leaves the browser, not how CSP blocks scripts. report-uri is a CSP directive that POSTs reports to a URL. The Reporting API uses a Report-To or Reporting-Endpoints…
Read guide →Safety · Feb 5, 2023
CSP report-only vs enforcing CSP is a staging-vs-production-policy split, not two equal headers. Content-Security-Policy-Report-Only tells the browser to send violation reports and still run every script your tags…
Read guide →Safety · Jan 28, 2023
CSP object-src vs browser plugins on public sites is a leftover plugin surface versus modern script policy. object-src limits URLs that may load in <object>, <embed>, and <applet>. Flash and Java-in-the-browser are gone…
Read guide →Safety · Jan 19, 2023
CSP nonces vs hashes is an allowlist technique, not a third policy language. A nonce is a per-response random value on script-src and matching script tags — browsers run those tags, not random inline XSS. A hash…
Read guide →Safety · Jan 11, 2023
CSP media-src vs mixed content for public video is two different media problems. Mixed content is an HTTPS page that still loads http:// video, audio, or other assets — browsers may block or padlock-warn. media-src in…
Read guide →