2

My company would use the current version of the Content-Security-Policy header.

We have problems with inline JavaScript and would not use MD5 checksums with the policy.

Eg:

  • CSRF Token support

https://craftcms.com/support/csrf-protection#updating-your-javascript

  • the login.html template

https://github.com/craftcms/cms/tree/master-v2/src/templates/login.html#L15

  • Maybe other source code files

Both the CSRF suggestion and the login implementation uses inline javascript.

Exist best practices to solve the problems? Without ESI how could I include the CSRF token in a separate Javascript file (access the Craft environment variables)?

Is it possible to add the header only for none CP requests?

Thanks

1
  • Just so we're on the same page, you want a CSP that explicitly doesn't allow any inline JavaScript, correct? Is it possible to add the header only for none CP requests? You can certainly only add the CSP headers for front-end requests via .htaccess.
    – Brad Bell
    Sep 26 '16 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.