Re: FW: Java Script Client

On Wed, May 28, 2014 at 6:57 AM, Stiegler, Marc <[email protected]>wrote:

>  Having said that, since you have studied this much more carefully than
> I, and since I would like to use CSP as a backup to strict hygiene (since I
> am an imperfect implementer of strict hygiene, and I have no one to review
> what I write), could you lay out what you would consider to be a correct
> CSP tag character by character, so I can incorporate it in all my pages?
>

Adding this HTTP header alone should be sufficient:


Content-Security-Policy: default-src 'self'


Or if you'd like to be more explicit:

Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src
'self'; frame-src 'self'; img-src 'self' data:; media-src 'self';
object-src 'self'; script-src 'self'; style-src 'self';


-- 
Tony Arcieri

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk