Content Security Policy Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:35:37Z

Point to the official site

2019-02-16T10:14:40Z

Migration to GitHub of the project

2015-06-09T20:19:00Z

‎Removing unsafe-inline: add more examples of refactoring inline code

2015-05-07T19:04:09Z

‎Authors and Primary Editors

2015-05-07T19:03:14Z

‎Preventing Clickjacking

2015-05-07T18:58:09Z

‎Preventing Clickjacking

2015-05-07T18:54:12Z

‎Mixed Content Policy

2015-04-24T05:33:07Z

‎CSP Sample Policies

2015-04-09T19:04:35Z

2015-04-09T19:02:52Z

← Older revision		Revision as of 14:35, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	An [https://~~github~~.~~com~~/~~OWASP~~/~~CheatSheetSeries/issues/13 open discussion~~] ~~is pending about~~ to ~~exclude or not this cheat sheet of~~ the V2 of the ~~project~~.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html Content Security Policy Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 118: / Line 118: @@
 When a report is generated, the blocked-uri will only have a value if it is the same origin as the page.
-= Removing unsafe-inline =
+= Refactoring inline code =
 Variable assignment in inline scripts. Rather than do this:

@@ Line 136: / Line 136: @@
 = Authors and Primary Editors =
-Neil Mattatall - neil[at]owasp.org<br/>
+* Neil Mattatall - neil[at]owasp.org
-Denis Mello - ddtaxe
+* Denis Mello - ddtaxe
 = Other Cheatsheets =

← Older revision		Revision as of 19:03, 7 May 2015
Line 113:		Line 113:

	The frame-ancestors directive MUST be ignored when monitoring a policy, and when a contained in a policy defined via a meta element.		The frame-ancestors directive MUST be ignored when monitoring a policy, and when a contained in a policy defined via a meta element.
		+
		+	In otherwords, this will not work when CSP is in a <meta> tag, and will not work when using Content-Security-Policy-Report-Only.
		+
		+	When a report is generated, the blocked-uri will only have a value if it is the same origin as the page.

	= Removing unsafe-inline =		= Removing unsafe-inline =

← Older revision		Revision as of 18:58, 7 May 2015
Line 109:		Line 109:

	A word about support. Not supported in all browsers yet, Chrome 40+ and FF 35+ support, but will also default to X-Frame-Options if it exists. Spec says, CSP should take precedence. https://w3c.github.io/webappsec/specs/content-security-policy/#frame-ancestors-and-frame-options		A word about support. Not supported in all browsers yet, Chrome 40+ and FF 35+ support, but will also default to X-Frame-Options if it exists. Spec says, CSP should take precedence. https://w3c.github.io/webappsec/specs/content-security-policy/#frame-ancestors-and-frame-options
		+
		+	Also, keep in mind the following (from the [https://w3c.github.io/webappsec/specs/content-security-policy/#frame-ancestors-and-frame-options CSP Spec]):
		+
		+	The frame-ancestors directive MUST be ignored when monitoring a policy, and when a contained in a policy defined via a meta element.

	= Removing unsafe-inline =		= Removing unsafe-inline =

← Older revision		Revision as of 18:54, 7 May 2015
Line 91:		Line 91:

	This is an example to block only active mixed content.		This is an example to block only active mixed content.
		+
		+	== Preventing Clickjacking ==
		+
		+	The established way of preventing clickjacking involves the use of the header <code>X-Frame-Options</code> (see: [[Clickjacking_Defense_Cheat_Sheet]]). However, CSP 2.0 has a new directive <code>frame-ancestors</code>.
		+
		+	To prevent all framing of your content use:
		+
		+	Content-Security-Policy: frame-ancestors 'none'
		+
		+	To allow for your site only, use:
		+
		+	Content-Security-Policy: frame-ancestors 'self'
		+
		+	To allow for trusted domain (my-trusty-site.com), do the following:
		+
		+	Content-Security-Policy: frame-ancestors my-trusty-site.com
		+
		+	A word about support. Not supported in all browsers yet, Chrome 40+ and FF 35+ support, but will also default to X-Frame-Options if it exists. Spec says, CSP should take precedence. https://w3c.github.io/webappsec/specs/content-security-policy/#frame-ancestors-and-frame-options

	= Removing unsafe-inline =		= Removing unsafe-inline =

← Older revision		Revision as of 05:33, 24 April 2015
Line 91:		Line 91:

	This is an example to block only active mixed content.		This is an example to block only active mixed content.
		+
		+	= Removing unsafe-inline =
		+
		+	Variable assignment in inline scripts. Rather than do this:
		+
		+	<script>var foo = "314";<script>
		+
		+	Leverage HTML5's custom data attributes by setting the value as follows:
		+
		+	<body data-foo="314”>
		+	...
		+	</body>
		+
		+	And access the value by doing:
		+
		+	var itemID = document.body.getAttribute("data-foo”);

	= Authors and Primary Editors =		= Authors and Primary Editors =

@@ Line 26: / Line 26: @@
 * '''Content-Security-Policy''' : W3C Spec standard header. Supported by Firefox 23+, Chrome 25+ and Opera 19+
 * '''Content-Security-Policy-Report-Only''' : W3C Spec standard header. Supported by Firefox 23+, Chrome 25+ and Opera 19+, whereby the policy is non-blocking ("fail open") and a report is sent to the URL designated by the '''report-uri''' directive. This is often used as a precursor to utilizing CSP in blocking mode ("fail closed")
-* '''X-Content-Security-Policy''' : Used by Firefox until version 23, and in Internet Explorer 10+ (which has incomplete implementation)
+* '''DO NOT''' use X-Content-Security-Policy or X-WebKit-CSP. Their implementations are obsolete (since Firefox 23, Chrome 25), limited, inconsistent, and incredibly buggy.
 == Directives ==