RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 16 of 20
Safety · Mar 3, 2023
CSP sandbox vs iframe sandbox for public pages is two places the same idea can live. The sandbox attribute on your <iframe> limits what that child document may do. The CSP sandbox directive applies sandbox flags to the…
Read guide →Safety · Feb 22, 2023
CSP require-sri-for vs Integrity-Policy for CDN scripts is two ways to demand Subresource Integrity — one of them is a CSP leftover. require-sri-for was a Content-Security-Policy directive that asked supporting browsers…
Read guide →Safety · Feb 14, 2023
CSP report-uri vs Report-To is how violation telemetry leaves the browser, not how CSP blocks scripts. report-uri is a CSP directive that POSTs reports to a URL. The Reporting API uses a Report-To or Reporting-Endpoints…
Read guide →Safety · Feb 5, 2023
CSP report-only vs enforcing CSP is a staging-vs-production-policy split, not two equal headers. Content-Security-Policy-Report-Only tells the browser to send violation reports and still run every script your tags…
Read guide →Safety · Jan 28, 2023
CSP object-src vs browser plugins on public sites is a leftover plugin surface versus modern script policy. object-src limits URLs that may load in <object>, <embed>, and <applet>. Flash and Java-in-the-browser are gone…
Read guide →Safety · Jan 19, 2023
CSP nonces vs hashes is an allowlist technique, not a third policy language. A nonce is a per-response random value on script-src and matching script tags — browsers run those tags, not random inline XSS. A hash…
Read guide →Safety · Jan 11, 2023
CSP media-src vs mixed content for public video is two different media problems. Mixed content is an HTTPS page that still loads http:// video, audio, or other assets — browsers may block or padlock-warn. media-src in…
Read guide →Safety · Jan 2, 2023
CSP manifest-src vs a web app manifest for public sites is two different files' jobs. The manifest is a public JSON document (often /manifest.json or a link rel=manifest) that names name, icons, start_url, and display…
Read guide →Safety · Dec 25, 2022
CSP img-src vs mixed content for public sites is two different image problems. Mixed content is an HTTPS page that still loads http:// images, scripts, or styles — browsers may block or padlock-warn. img-src in…
Read guide →Safety · Dec 16, 2022
CSP frame-src vs object-src for embeds on public sites is two fetch allowlists that people mix up. frame-src lists URLs that may load in nested browsing contexts — typically <iframe>. object-src lists URLs for <object>,…
Read guide →