0

We host a bunch of websites, and at the moment our Content-Security-Policy header has a number of directives of this kind:

add_header   Content-Security-Policy  "default-src 'self' 
                 *.googleapis.com  platform.twitter.com...etc...
                 *.MYDOMAIN.COM  cdn.MYDOMAIN.COM  cdn2.MYDOMAIN.com
                 *.DOMAIN2.COM   cdn5.DOMAIN2.COM  ..etc..

And so on. Therefore in our headers, all our domains are listed. This is ugly. Is there a way to mark subdomains in a way that self covers it?

add_header   Content-Security-Policy  "default-src 'self' 
                 *.googleapis.com  platform.twitter.com...etc...
                 *.self  cdn.self  cdn2.self ..

Something like that, a *.self type command that lets us avoid spelling out every subdomain we have for CDN etc?

Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.