RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 6 of 7
Safety · Jan 2, 2023
CSP manifest-src vs a web app manifest for public sites is two different files' jobs. The manifest is a public JSON document (often /manifest.json or a link rel=manifest) that names name, icons, start_url, and display…
Read guide →Safety · Dec 25, 2022
CSP img-src vs mixed content for public sites is two different image problems. Mixed content is an HTTPS page that still loads http:// images, scripts, or styles — browsers may block or padlock-warn. img-src in…
Read guide →Safety · Dec 16, 2022
CSP frame-src vs object-src for embeds on public sites is two fetch allowlists that people mix up. frame-src lists URLs that may load in nested browsing contexts — typically <iframe>. object-src lists URLs for <object>,…
Read guide →Safety · Dec 7, 2022
CSP frame-ancestors none vs self is who may put your document in a frame: 'none' matches X-Frame-Options DENY (no parent, including your own origin), and 'self' matches SAMEORIGIN so same-origin tools may iframe the…
Read guide →Safety · Nov 29, 2022
CSP form-action vs open redirects on public sites is two different hops. form-action in Content-Security-Policy tells supporting browsers which origins an HTML form may submit to. An open redirect is a server Location…
Read guide →Safety · Nov 20, 2022
CSP font-src vs hosted web fonts on public sites is a fetch allowlist versus a privacy and supply-chain choice. font-src lists which origins may provide fonts for @font-face. style-src still controls the stylesheet that…
Read guide →Safety · Nov 12, 2022
CSP default-src vs named directives for public sites is a fallback versus an explicit fetch type. default-src sets the allowlist for fetch types you did not name — scripts, images, fonts, connect, and more, with…
Read guide →Safety · Nov 3, 2022
CSP connect-src vs public JavaScript API keys is a destination allowlist versus a credential in the browser. connect-src in Content-Security-Policy limits fetch, XHR, WebSocket, and EventSource URLs the page may open. A…
Read guide →Safety · Oct 26, 2022
CSP child-src vs worker-src for public sites is an old combined directive versus the split that replaced it. child-src used to cover nested browsing contexts (frames) and workers. Today, frame-src lists which hosts may…
Read guide →Safety · Oct 17, 2022
CSP base-uri vs open redirects on public sites is two different ways URLs get rewritten. base-uri in Content-Security-Policy limits which origins may appear in a <base href> (and the fallback document URL). An injected…
Read guide →