I am trying to set the Strict-Transport-Security header in my ASP.NET Core application to enforce HTTPS with a max-age of 1 year (31536000 seconds), along with includeSubDomains and preload. However, when I check the headers in the browser, the max-age…
This my error I'm still a beginner in creating Laravel Livewire applications, how to make CSP allow livewire.js When I don't use Content Security Policy Livewire runs fine, after I use Content Security Policy with spatie livewire.js is blocked, what…
I am using CSP on my website to keeps things locked down as much as possible. I have an HTML editor on the website, and I wanted to allow users to choose text colors from a color picker. This involves…
SPA & Network screenshot I have a React SPA with only one request to my Node.js + express server with header "Content-Security-Policy" set to default-src 'none'. Although it still loads everything. What am I doing wrong? P.S: incognito mode does…
I’ve tried to follow mozilla guide lines for setting up report-uri in CSP-Report-Only mode. My CSP: function add_csp_header() { header("Content-Security-Policy-Report-Only: report-uri ".get_bloginfo('url')."/csp-endpoint; script-src 'self'"); //some more, since only one header is rejected } add_action('send_headers', 'add_csp_header',10); The csp-endpoint file at the…
We're updating our Magento from 2.4.5-p7 to 2.4.5-p8. As you know, in Magento 2.4.5-p8 the CSP on the checkout page is now restrict mode instead of report-only. We know now that the scripts inserted through our magento's modules/theme must be…
I'm trying to adjust the security headers. The server is Apache. the site is based on wordpress. I've already modified this file ten times, I've uploaded it to the server ten times and I still haven't figured out what I'm…
I have an HTML page that is designed to be iframed into a different website. With a CSP frame-ancestors directive I can restrict in which pages it is allowed to be iframed. This disallows iframing into the wrong site which…
I have a big legacy web app that needs to be made CSP (content security policy) compliant. It is full of inline event handlers, eg onclick="alert('hello')" I am trying to write some js which will scan the page on load…
I have tried to add Auth0 to my application, which works locally but when I deploy to an S3 bucket I get the following error: "Refused to connect to 'https://dev-.us.auth0.com/oauth/token' because it violates the following Content Security Policy directive: "default-src…