I’m testing out the awesome CSP that was added ( Mitigate XSS Attacks with Content Security Policy ). I’ve currently had it in report only mode since release, and am seeing a large number of CSP Violation: 'inline' reports on /logs that are violating the script-src. I’m guessing the best way to avoid…

I can’t recall where we are on logster @pmusaraj ? Also make sure you update to latest and do a full container rebuild at the command line.

[图片] codinghorror: Also make sure you update to latest and do a full container rebuild at the command line. Ahh, does the web upgrade not cover quite as much? I can login tonight and get an upgrade done via SSH.

These 'inline' CSP violation errors are in most cases false positives. If you can post the contents of the env tab from the log, that will have some more details, but I’m fairly certain this is coming from an extension. The vast majority of CSP report violations logged are false positives, and we w…

[图片] pmusaraj: and we will shortly turn off reporting by default, because it’s not very helpful We still haven’t done this? We need to get this done..

[图片] pmusaraj: These 'inline' CSP violation errors are in most cases false positives. If you can post the contents of the env tab from the log, that will have some more details, but I’m fairly certain this is coming from an extension. The vast majority of CSP report violations logged are false …

Ah, I see that violation in the Chrome console as well (but not on Safari or Firefox) when visiting gamingexodus.com . You can either turn on CSP in full or turn on violation report logging temporarily, Chrome needs one of the two to display more details about the source of the CSP violation.

Just toggled the full CSP on. Oddly enough, I’m not seeing any of the errors now. Do I need to rebuild the Docker image after enabling the full CSP option? As an aside, I think the two CSP options should be mutually exclusive. You should only be able to select report only CSP, full CSP, or no CSP. …

仅报告 CSP 违规

支持

pmusaraj (Penar Musaraj) 2019 年1 月 15 日 15:44 8

CSP violation reporting is now off by default as of FEATURE: enable CSP by default on new sites (#6873) · discourse/discourse@1c1fd20 · GitHub

话题		回复	浏览量
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25672	2023 年6 月 13 日
After upgrade the content security policy script src for GTM Data & reporting	4	1978	2021 年4 月 13 日
Discourse refused to load with CSP policy error after rebuild Support	4	2956	2019 年5 月 8 日
How to fix problem with CSP Support	8	6865	2022 年3 月 9 日
A user cannot login due to CSP issue Support	4	559	2023 年9 月 30 日

仅报告 CSP 违规

相关话题