Content-Security-Policy

[aravinda3001]

Content-Security-Policy : Wildcard Directive

Changes proposed in the pull request

• Ensure that web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

Impact

The configurations either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: frame-ancestors, form-action

Other information

Reference: http://www.w3.org/TR/CSP2/ http://www.w3.org/TR/CSP/ http://caniuse.com/#search=content+security+policy http://content-security-policy.com/ https://github.com/shapesecurity/salvation https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources