search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
532 stars 46 forks source link

Adding Content-Security-Policy (CSP) to website to protect users against XSS attacks #2756

Open ghost opened 7 years ago

ghost commented 7 years ago

This CSP can be easily added in github pages as explained here and would add more security to the site by protecting users against XSS attacks.

andrewdavidwong commented 7 years ago

Cool! Thanks for pointing this out.

I think we'd just want 'self' for everything. Is there an easy way to do that for all directives, or must we specify each one?

CC @marmarek

marmarek commented 7 years ago

There may be more. Hmm, what is this?! Not so careful grep doesn't reveal anything else.

iamahuman commented 3 years ago

Hmm, what is this?! Not so careful grep doesn't reveal anything else.

Permalink: https://github.com/QubesOS/qubesos.github.io/blob/f04cbc292c64c3422d5096c9059f36335c4249f0/_includes/head.html#L99-L104

IE<10 doesn't support CSP, so I suppose it can be ignored. That is, if IE is still a thing.