(X-)Content-Security-Policy

Open mnot opened this issue 14 years ago • 4 comments

response_analyse - check syntax, semantics

Jul 20 '11 13:07 mnot

This is also something that would interest me, but it might be better to wait until it becomes more stable, there's still implementation differences between Firefox and Chrome.

Jul 24 '12 19:07 anthonyryan1

https://csp-evaluator.withgoogle.com

Oct 04 '16 01:10 mnot

https://www.cspvalidator.org/

Oct 25 '17 23:10 mnot

Also check that CSP applies to appropriate MIME-types, see https://github.com/w3c/webappsec/issues/520. For reference, H5BP settled on matching against text\/(html|javascript)|application\/pdf|xml in their apache configs.

Nov 06 '19 14:11 Malvoz