2

I'm looking to improve the security of my site with a Content Security Policy. I have set one up for my site in htaccess (using Content-Security-Policy-Report-Only and doing everything possible to iron out what's required and then re-testing with the policy in place). I have good extensions and I'm relatively happy with the theme my site uses but I found that I had to add to my security policy for scripts the following:

script-src 'self' 'unsafe-inline' 'unsafe-eval'

and then to the image policy:

img-src 'self' data:

all my other policies are filled with either 'self' or analytics, google maps or captcha url's, the cdn url and a few extension url's (images in the back end configuration loaded from extension developers sites or site extension validation scripts etc).

What are the risks of 'unsafe-inline', 'unsafe-eval' and data:? How will these effect protection from cross-site attacks and if they do, which ones should I hunt down to get rid of so I can improve my content security policy?

Improve this question
1
  • This might be same issue and relevant to a recent question on Magento 2 (magento.stackexchange.com/questions/136107/…) and maybe not secure with the 'unsafe' bits, and down to Magento and not necessarily extensions and theme. Will leave this open though. I presume that if I have 'self' and specified domains (like the cdn) and no generalised sources like "https" then this will at least provide something in terms of security except for compromised browsers? Very sketchy area for me. I'm happier with css and html personally!
    – Jaimie Dijstra
    Commented Nov 23, 2016 at 16:00

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.