2,931 questions
0
votes
0
answers
66
views
JS SDK v6 – onApprove not triggered, FraudNet CORS error
I am integrating the PayPal JavaScript SDK v6 into my web application and experiencing a critical issue in the Sandbox environment: the onApprove callback is never called after the buyer clicks the &...
- 29
0
votes
0
answers
82
views
How to implement CSP without 'unsafe-inline' in WordPress (Elementor) without breaking site?
I am working on securing a WordPress website that uses Elementor and several plugins.
I have implemented a Content Security Policy (CSP) via .htaccess like this:
Header always set Content-Security-...
Advice
1
vote
1
replies
92
views
How to have separate ContentSecurityPolicy.php for different environments in CI4?
I am enabling CSP for a CI4 project and I wonder how we can have different Content Security Policy directives for development and production.
Separate ContentSecurityPolicy.php files in Config\...
- 4,368
1
vote
0
answers
106
views
How to make gtm.js SPFX integration work with the new Content Security Policy (CSP)?
My organisation couldn't test the new Sharepoint CSP policies ahead of time on our dev tenant and now I am trying to make our Google Tag Manager integration through SPFX Extension Custom Appplication ...
- 11
0
votes
1
answer
96
views
Laravel: HttpOnly flag is not set in the session cookie dispite 'http_only' set true in session config
Based on Laravel documentation and also posts on similar issues, it seems once we set http_only true, which is already true by default, HttpOnly flag will be set in HTTP response header. But this is ...
- 609
-3
votes
2
answers
125
views
What is the best way to create a function where the code is dynamic? [closed]
How can I create and run a function based on a function name from a string?
I need to redo some stuff because we are changing our CSP to block unsafe-inline and unsafe-eval. What I am trying to do ...
- 137
-1
votes
2
answers
64
views
Trying to generate nonce in Netscaler version 14.1 with random hash for CSP Header [closed]
I am using the NetScaler GUI version 14.1, I am trying to find the correct way to do the following, however I cannot seem to get it right with the options I am given. Does anyone happen to have a ...
- 1
-1
votes
1
answer
51
views
Angular Service Worker fetch fails after new release with CSP update (Geoapify / OpenStreetMap example)
After our latest Angular app release, which included a CSP update, some functionality broke, specifically related to map tiles.
Scenario:
The app was originally using Google Maps, which worked fine.
...
1
vote
1
answer
363
views
How to implement a strict Content Security Policy with nonce using Apache and Angular (20.3) SSR?
I have spent the entire morning trying to implement a strict Content Security Policy (CSP) using nonces with Apache and Angular 20.3 SSR.
On the Apache side, I am able to generate a nonce correctly ...
0
votes
2
answers
246
views
CSP - Possible to have GTM without unsafe-inline?
I have to secure a checkout that includes a nonce aware GTM script code:
<script nonce="eWp5ejMyZjFiZDRzMzBwZjc1M3dhYXdpNHRnM3RoNjc=">(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm....
- 1,658
0
votes
0
answers
40
views
Is it possible to achieve Content Security Policy compliance (remove 'unsafe-inline') without migrating inline script block to an external .js file?
In my ASP.NET MVC 5 project, I am migrating to a strict Content Security Policy (CSP) to eliminate the use of 'unsafe-inline' for scripts. While I have successfully implemented the nonce approach to ...
0
votes
1
answer
75
views
Sinatra app Content Security Policy nonce for inline script not working
In my very simple Sinatra app I have a home page on which there is form which needs to be submitted through AJAX and the HAML template needs to execute some JS code. And I need to set the Content-...
- 6,588
Advice
3
votes
2
replies
315
views
React Router v7 SPA mode: How to use strict CSP?
I'm migrating an app from React Router v6 + Webpack to React Router v7 (SPA mode) + Vite and I'm having issues with setting a strict Content Security Policy.
In RR6 I had a normal index.html and ...
- 131
1
vote
0
answers
53
views
Debugging missing NEL reports
I'm trying to use NEL reporting in Chrome. As far as I can see, everything is configured correctly, but no errors are reported.
My NEL header:
Nel: {"report_to":"nel","max_age&...
- 38.1k
1
vote
1
answer
189
views
Content Security Policy, Clarity in img-src
I'm adding Clarity to my content security policy (CSP). Somehow, I'm getting a blockedUrl: https://c.clarity.ms:443/c.gif on img-src even though my policy includes both *.clarity.ms and the same with …...
- 5,224