Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CSP example explanation #34286

Merged
merged 2 commits into from
Jun 21, 2024
Merged

Fix CSP example explanation #34286

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ee94d02
Fix CSP example explanation
Josh-Cena Jun 20, 2024
852c10b
Update index.md
Josh-Cena Jun 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions files/en-us/web/http/csp/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,14 +122,14 @@ The server permits access only to documents being loaded specifically over HTTPS

### Example 5

A website administrator of a web mail site wants to allow HTML in email, as well as images loaded from anywhere, but not JavaScript or other potentially dangerous content.
A website administrator of a web mail site wants to allow HTML in email, as well as images loaded from anywhere, but JavaScript or other potentially dangerous content can only come from the same origin as the mail server.

```http
Content-Security-Policy: default-src 'self' *.example.com; img-src *
```

Note that this example doesn't specify a {{CSP("script-src")}}; with the example CSP,
this site uses the setting specified by the {{CSP("default-src")}} directive, which means that scripts can be loaded only from the originating server.
this site uses the setting specified by the {{CSP("default-src")}} directive.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think about this?

Suggested change
this site uses the setting specified by the {{CSP("default-src")}} directive.
so the {{CSP("default-src")}} directive will be used for JavaScript sources as a fallback.


## Testing your policy

Expand Down