Bezpieczeństwo
security/csp-strict
Production pages send a strict Content Security Policy (nonces or hashes with strict-dynamic, object-src none, base-uri none).
umiarkowanaw przeglądarcefe-security
Dlaczego
A CSP is the second line of defence against XSS: when an injection slips through, the browser refuses to run script the policy did not allow. Allowlists of domains are easy to bypass; 'unsafe-inline' and 'unsafe-eval' switch the protection off.
Poprawka
Send script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none' with a fresh unguessable nonce per response (server-rendered apps), or hashes of inline scripts for static sites. Roll out with Content-Security-Policy-Report-Only first and a reporting endpoint, then enforce. Next.js, Nuxt, SvelteKit and Astro document nonce or hash support; use it instead of hand-writing headers.
Przykłady
Content-Security-Policy: script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'Źródła
Fakty
- Identyfikator
security/csp-strict- Waga
- umiarkowana
- Sprawdzanie
- w przeglądarce wymaga wyrenderowanej strony:
audit --url - Dotyczy plików
page- Ten sam problem w
- Lighthouse
csp-xss - Uczy jej skill
fe-securityFront-end security- Od wersji
- 0.1.0
Przeczytaj w terminalu
npx github:dawidolko/frontend-skills explain security/csp-strict