Title: Set `default-src` CSP Attribute to `none` by default · Issue #482 · github/secure_headers · GitHub
Open Graph Title: Set `default-src` CSP Attribute to `none` by default · Issue #482 · github/secure_headers
X Title: Set `default-src` CSP Attribute to `none` by default · Issue #482 · github/secure_headers
Description: At GitHub, we set the default-src CSP attribute to none. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted. It would be desirable to set this default in secure_heade...
Open Graph Description: At GitHub, we set the default-src CSP attribute to none. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted. It would be desir...
X Description: At GitHub, we set the default-src CSP attribute to none. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted. It would be d...
Opengraph URL: https://github.com/github/secure_headers/issues/482
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Set `default-src` CSP Attribute to `none` by default","articleBody":"At GitHub, we set the `default-src` CSP attribute to `none`. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted. \r\n\r\nIt would be desirable to set this default in `secure_headers` as well:\r\n\r\nhttps://github.com/github/secure_headers/blob/7f89df2dafb22f1833702eef4a01d4794b2066f0/lib/secure_headers/headers/content_security_policy_config.rb#L133\r\n\r\nThis would be a breaking change, so if this is desirable, this would fit well in with https://github.com/github/secure_headers/issues/480\r\n","author":{"url":"https://github.com/rzhade3","@type":"Person","name":"rzhade3"},"datePublished":"2022-04-05T17:24:07.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/482/secure_headers/issues/482"}| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:57966a99-5d16-0c11-210a-9d2af80c3276 |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | 9436:A4DA3:12ABE70:194FF75:6964A94D |
| html-safe-nonce | c9ac883c7f061c558cc9e953592059f665fd74144686e3e3954a2cd609d5158f |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5NDM2OkE0REEzOjEyQUJFNzA6MTk0RkY3NTo2OTY0QTk0RCIsInZpc2l0b3JfaWQiOiI2NzU3OTY1MzkzNzI1NTMyNDkzIiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | dfab4755d1c7f208ce144a40a700f7bad394871ed2236651f9c1751894b01136 |
| hovercard-subject-tag | issue:1193499988 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/github/secure_headers/482/issue_layout |
| twitter:image | https://opengraph.githubassets.com/566376cc939ccfd3aa246e5844786180da984e520c0f0db3515e0471347d211c/github/secure_headers/issues/482 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/566376cc939ccfd3aa246e5844786180da984e520c0f0db3515e0471347d211c/github/secure_headers/issues/482 |
| og:image:alt | At GitHub, we set the default-src CSP attribute to none. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted. It would be desir... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | rzhade3 |
| hostname | github.com |
| expected-hostname | github.com |
| None | 15579c46431b7fd25941c3b09010f74fd1890c7a35226839bbbf40ce70fb3057 |
| turbo-cache-control | no-preview |
| go-import | github.com/github/secure_headers git https://github.com/github/secure_headers.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 7122663 |
| octolytics-dimension-repository_nwo | github/secure_headers |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 7122663 |
| octolytics-dimension-repository_network_root_nwo | github/secure_headers |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 499abb347cb197601d399c346cfeb4b3fa135d5c |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width