search

krakenjs / lusca

Application security for express apps.
Other
1.78k stars 123 forks source link

support for CSP's block-all-mixed-content #69

Closed turboMaCk closed 8 years ago

turboMaCk commented 8 years ago

It will be nice to have support for: Content-Security-Policy: block-all-mixed-content

http://www.w3.org/TR/2015/CR-mixed-content-20151008/ and even http://www.w3.org/TR/2015/CR-upgrade-insecure-requests-20151008/

Hacky solution:

csp: { policy: { '': 'block-all-mixed-content' } }
jasisk commented 8 years ago

Makes sense to me. :+1: