Slide 43
Slide 43 text
Content-‐Security-‐Policy
• Content-‐Security-‐Policy
43
Content-‐Security-‐Policy:
default-‐src
'self';
img-‐src
img.example.jp
DEMO
'self'
ドキュメント自身と同一オリジンの場合にのみ許可する
Refers
to
the
host
from
which
the
protected
document
is
being
served,
including
the
same
URL
scheme
and
port
number
'none'
どのオリジンも許可しない
Refers
to
the
empty
set;
that
is,
no
URLs
match.
The
single
quotes
are
required.
'unsafe-‐inline'
script-‐src、style-‐srcにおいてインラインでのスクリプト記述、スタイル記述を許
可する
Allows
the
use
of
inline
resources,
such
as
inline
elements,
javascript:
URLs,
inline
event
handlers,
and
inline
<style>
elements.
You
must
include
the
single
quotes.
'unsafe-‐eval'
JavaScript内でのeval、Func7on、setTimeout、setIntervalといった文字列から
コードを生成する機能を許可する
Allows
the
use
of
inline
resources,
such
as
inline
<script>
elements,
javascript:
URLs,
inline
event
handlers,
and
inline
<style>
elements.
You
must
include
the
single
quotes.