A starting Content-Security-Policy

Plaintext

Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing.

Content-Security-Policy:
  default-src 'self';
  script-src 'self';
  style-src 'self';
  img-src 'self' data:;
  object-src 'none';
  base-uri 'self';
  frame-ancestors 'none'

Download

Security csp headers web chris

More in Security

Compare secrets in constant time Security A plain === leaks how much of the token matched through its timing. This does not. Generate a strong random secret Security For session keys and tokens. Never reach for a password generator or a UUID for this. Check a file's checksum Security Verifies a download actually matches what the publisher signed, rather than trusting the transfer. Generate an SSH key and add it to the agent Security Ed25519 rather than RSA: shorter, faster, and no key-size decision to get wrong. Security headers for an Express app Security The handful worth setting even when you are not using a framework that sets them for you.

Random picks

Cache busting with a content hash Build & CI Names the built file after its contents so a deploy invalidates the cache without a version bump. A semantic, accessible form field Web & CSS The label is tied to the input by id, and the hint is announced with it via aria-describedby. Find the commit that introduced a bug Git Binary search across history. Mark a known good and a known bad commit and git narrows it down for you. Shell into a running container Containers Falls back to sh, since slim images often have no bash. Table sizes, largest first Databases Where the disk actually went, including indexes and TOAST. Find the largest files under a directory Shell Sorts everything beneath the working directory by real disk usage and shows the twenty worst offenders. Read a large file without loading it into memory Python Iterating a file object yields one line at a time, which is the difference between a constant footprint and an OOM. Serve the current directory over HTTP Shell Three ways to put a folder on localhost when you need to test something quickly.