Top "Content-security-policy" questions

Content Security Policy (CSP) aims to mitigate the risk of cross-site scripting attacks by giving developers fine-grained control over the resources a page is allowed to load, as well as the script it's allowed to execute.

Injecting iframe into page with restrictive Content Security Policy

I want to create a browser extension which creates a sidebar. Chrome does not have a first-class sidebar, and so …

google-chrome-extension content-security-policy
Chrome extension Content Security Policy directive error

I'm trying to make radio stream chrome extension but there is a problem. When I run my script in browser …

javascript html google-chrome google-chrome-extension content-security-policy
Content Security Policy: cannot load Google API in Chrome extension

This is relative an Chrome extension. I am trying a simple one which uses the Google Chart API I have …

javascript google-chrome-extension google-api content-security-policy
How to fix chrome-extension inline JavaScript invocation error?

I'm making a chrome extension however I seem to get the following error when I try to fire up an …

javascript google-chrome google-chrome-extension content-security-policy
How to set X-Frame-Options Allow-From in nginx correctly

Im trying to set the ALLOWED-FROM in Nginx but all settings I tried so far resulted in the following Chrome …

nginx cross-domain content-security-policy x-frame-options
Violating Content Security Policy directive after ember-cli 0.0.47 upgrade

I upgraded my ember-cli app to 0.0.47 and am now getting a bunch of errors in my browser console related to …

ember.js ember-cli content-security-policy
Allow All Content Security Policy?

Is it possible to configure the Content-Security-Policy to not block anything at all? I'm running a computer security class, and …

javascript web http-headers xss content-security-policy
Jenkins Content Security Policy

I'm confused about Jenkins Content Security Policy. I know these sites: Configuring Content Security Policy Content Security Policy Reference I …

html css jenkins content-security-policy
Cordova Content Security Policy

I have a Cordova app and after upgrading (5.0.0) it I'm unable to call any resource at all. I've added the …

cordova ionic-framework azure-mobile-services visual-studio-cordova content-security-policy
Trying to render iframe: ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"

I would like to render an iframe with the source being Github like so: <iframe src="https://gist.github.…

node.js iframe heroku content-security-policy