Post
A+ CSP Scan
Thank you Mozilla Observatory CSP Scan for A+ Scan Test Score!
2022-05-07
A+ CSP Scan
Did you know what, some CSP are ignored when you only it set in the META HTML Header?
The X-Frame-Options are ignored, when not included in the header response. \nOnly allow my site to frame itself \nContent-Security-Policy: frame-ancestors 'self' \nX-Frame-Options: SAMEORIGIN
We override the default Document in the Next Web app. \nclass CustomDocument extends Document\nctx.res.setHeader\nctx.res.setHeader('Content-Security-Policy', generateCSP({ nonce }) )\n