search

rumkin / plant

🌳 JS web server charged with WebAPI and neat HTTP2 support
https://npmjs.com/package/@plant/plant
80 stars 6 forks source link

Harden default CSP #10

Open rumkin opened 5 years ago

rumkin commented 5 years ago
  1. Use default-src 'none' for most resource types.
  2. Create exceptions list for resources which may have 'self' value:
    • styles
    • scripts
    • images
rumkin commented 5 years ago

Decided to add several CSP sets for local development, testing and production purposes. Default is LOCAL which allows only localhost to be a source of data. STRICT is production version it denies everything using default-src 'none' and define exact resources to use https protocol with origin hostname.