Add carbonads support - Githubissues

certsimple / csp-by-api

Significantly cuts down on CSP policy management by specifying common APIs by name.

17 stars 6 forks source link

Open XhmikosR opened 6 years ago

mikemaccana commented 6 years ago

Send a PR!

mikemaccana commented 6 years ago

Did you send a PR?

XhmikosR commented 6 years ago

As you clearly see, no. There is no clear list of hosts they are serving ads from. Or at least one, I'm aware of.

mikemaccana commented 6 years ago

No problem. To make a PR adding support for CarbonAds:

Ask support at CarbonAds to send you a list of hosts to allow for Content Security Policy, and mention you couldn't find this in their documentation (better services ,especially ones you pay for, will usually send it)
If that doesn't work, start with en empty policy and adding hosts until there are no more warnings. Then send a PR.

XhmikosR commented 6 years ago

I have already asked them and they haven't a clear list of hosts. Which is very annoying because I have to see the failures by myself. Anyway, my current CSP is https://github.com/MaxCDN/bootstrapcdn/blob/develop/config/helmet-csp.js