Tips to build a Content Security Policy (CSP) without breaking your site

blog.rapidsec.com

23 pointsshaial4 comments

I'm wary of #4, involving managing CSP dynamically. It feels like another moving part in an already complex ecosystem, another potential thing that could go wrong. Anyone else doing it the way shown there, unfounded concerns?

I get your point. There is certainly a spectrum here. I can tell you (as the author) that for mission-critical assets with less 3rd party dependencies - I do see that most prefer to use the hard-coded or policy, or pull it via api per build in the CI/CD.

However for more dynamic websites (like blogs) that tend to have many 3rd party dependencies - It's very useful and effective to be able to update the policy with one click (or even automatically).

Article is sploggy but the topic is worth knowing about. Maybe there is something better out there.

How would you improve the content?

Reply on news.ycombinator.com