Closed turboMaCk closed 7 years ago
@thefourtheye see last commit with null test.
I'm for it. :+1:
Ready from my side.
Any feedback on this?
It looks good to me :+1:. I'll let @jasisk do the final merge though since he's the lead maintainer
Hey @turboMaCk. Sorry for the delay—had a few speed bumps lately but I'm back. Let me think on this for a day or two. In any case, thanks for your contribution and patience!
@jasisk Sure! No problem man.
maybe it will be good to think about this one more time.
I really like this PR: https://github.com/krakenjs/lusca/pull/72
what about doing it this way:
"policy": {
"global": ["block-all-mixed-content", "upgrade-insecure-requests"],
"default-src": ["'self'",
"https://*.google-analytics.com",
"https://*.mydomain.com",
"https://*.mydomain2.com",
"http://*.mydomain2.com"],
"script-src": ["'self'",
"https://*.google-analytics.com",
"https://*.mydomain.com",
"https://*.mydomain2.com"]
}
Doing some cleanup here, closing this since #79 has this change and more
improve CSP support for: