# Mitigate XSS Attacks with Content Security Policy

**URL:** https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243
**Category:** Site Management
**Tags:** how-to, content-security-policy
**Created:** [December 14, 2018, 4:38pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243 "2018-12-14T16:38:20Z")
**Posts on this page:** 1
**Showing post:** 24

<div class="post-metadata">

### Author: ![adrelanos](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/adrelanos/32/121409_2.png) [@adrelanos](https://meta.discourse.org/u/adrelanos)
#### Post date: [June 2, 2020, 4:07pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/24 "2020-06-02T16:07:41Z")

</div>

Could you please add a [Feature-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)?

This is the one that I am using for more than a year now. (host nginx)

> add\_header Feature-Policy “geolocation ‘none’; midi ‘none’; notifications ‘self’; push ‘none’; sync-xhr ‘none’; microphone ‘none’; camera ‘none’; magnetometer ‘none’; gyroscope ‘none’; speaker ‘none’; vibrate ‘none’; fullscreen ‘none’; payment ‘none’;”;

* * *

Would it make sense to add the following to `Content-Security-Policy` header? This is what I am successfully using (added by host nginx, on top of discourse built-in CSP):

```
default-src 'none'
style-src 'self' domain 'unsafe-inline'
img-src https://*.domain.org data: blob: 'unsafe-inline'
font-src 'self' domain
connect-src 'self' domain
manifest-src 'self' domain

```

---

_[View the full topic](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)._