10
votes
Refused to frame '' because it violates the following Content Security Policy directive: "frame-src *"
Had exactly that problem today.
I solved it by using
frame-src data:
Btw. '*' is only a wildcard for urls. data: 'unsafe-inline' and 'unsafe-eval' have to be added individually.
- 101
3
votes
How to determine CSP for Wordpress
Use the header Content-Security-Policy-Report-Only first (Content-Security-Policy-Report-Only). This will allow you to test the policy and tune it. It works the same as the "regular" CSP ...
- 1,038
2
votes
Accepted
How do allow fontawesome as a style-src in my Content-Security-Policy?
The header value must be quoted if it is meant to contain whitespace.
Your first example properly quotes the value, but your second example does not.
- 248k
2
votes
How to inject random CSP nonce in APACHE?
@user3526609 gets credit for this wonderful solution, but I wanted to summarize it to make it clear for any others out there like me who hunted everywhere for this and found it buried in a comment.
In ...
- 131
2
votes
How to inject random CSP nonce in APACHE?
The nonce you set up in your CSP header has to be the same you use with your script tag. That's why it is typically set at the application level, where the save value can be used in the HTTP header ...
- 1,038
2
votes
Content-Security-Policy for Exchange 2016
I would just like to contribute to 'Matthew L' answer (and thank him also for pointing in right direction), cause it is pretty much the same for Exchange 2013 except you don't need https://.microsoft....
- 21
2
votes
How to create a CSP nonce and yet continue website caching?
tl;dr: you can keep caching responses with nonces in them like you normally would, and CSP will still provide a strong defense against common XSS attacks.
This is an interesting question: when a page ...
- 171
1
vote
Google Cloud Services Content Security Policy Issues
As it was suggested in the comment section by @Bruno this issue was already solved in this question. For better usability I'm copy-pasting (with links) two solutions that users confirmed worked;
...
1
vote
Accepted
Content-Security-Policy for Exchange 2016
The answer above may have worked in Exchange 2010 but wreaks havoc in OWA on 2016. OWA in Exchange 2016 likes to use resources loaded from microsoft.com and sharepoint.com (as well as the data: ...
- 26
1
vote
Prevent Unjoined-to-domain computers from connecting to my network
I guess this is not possible on the TCP/IP level.
You could either secure every single service using AD authentication.
If a service doesn't support this natively, you can try using a proxy (e.g. ...
- 396
1
vote
How to inject random CSP nonce in APACHE?
In Apache you must have module called mod_unique_id enabled. He generates a unique environment variable (UNIQUE_ID). However, its encoding has illegal characters for csp [A-Za-z0-9@-] instead of the ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
content-security-policy × 26nginx × 9
security × 4
cache × 4
apache-2.2 × 3
apache-2.4 × 3
http-headers × 3
centos7 × 2
.htaccess × 2
google-cloud-platform × 2 wordpress × 2
apache2 × 2
javascript × 2
http-caching × 2
linux × 1
ubuntu × 1
centos × 1
iis × 1
firewall × 1
web-server × 1
proxy × 1
virtualhost × 1
domain × 1
selinux × 1
ip-address × 1