CSP framework - Githubissues

contao / docs

Contao Documentation

https://docs.contao.org

Other

31 stars 149 forks source link

CSP framework #1294

Closed Toflar closed 7 months ago

Toflar commented 7 months ago

Contao 5.3 ships with a superbe CSP framework, which we should document in both, the user as well as the developer manual.

What is CSP?
How to enable it
How to add the nonce to your own scripts in templates
How to use hashes in templates
How to have Contao apply hashes to inline styles of WYSIWYG data

fritzmg commented 7 months ago

See #1303

What is CSP?

I skimped out on this one - but I can still add the basic gist to the manual if need be (I don't think we should or can document in much detail what CSP is and does and all its implications).

fritzmg commented 7 months ago

I've linked to https://content-security-policy.com/ in both the dev docs as well as the manual. The very first paragraph is What is Content-Security-Policy?

Do you think this is enough? Or should we quote this paragraph in the manual for example, along with a German translation.

Toflar commented 7 months ago

I think that's enough :)