Hacker News Reader

Setting a CSP header can be simple but managing changes to it can get difficult. Especially as team members add or remove services from the app (Intercom, Google Analytics, etc.)

We also provide a reporting endpoint that captures all violations. Do you currently use a CSP header with a report-uri setting?

View on HN

Ahh that makes sense. We have an API-driven SPA, so our API is just banned from returning anything fun. But I can see how this becomes an for apps with server-side rendering based on how annoying it is to manage the CSP on our front end.

Have you actually found much value from these reports? Most people I talk to tell me they're full of garbage.

Noise is a problem and we are in this fight to improve exactly that.

There is clearly noise, but is there any signal at all? I wouldn't be surprised if there was no signal to be found.

There is a lot more signal than noise, especially they way we aggregate the security reports. CSP can be deployed in report only mode, which provides a great way to detect how your policy has to come together.

I guess in my mind signal == attacks, but I guess there's also value in having reports when your policy broke things if you don't have other methods for detecting that, or if your integration tests disable CSP.

Reply on news.ycombinator.com