Repository navigation
Set default-src CSP Attribute to none by default #482
Description
At GitHub, we set the default-src CSP attribute to none. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted.
It would be desirable to set this default in secure_headers as well:
This would be a breaking change, so if this is desirable, this would fit well in with #480
Activity
vcsjones commentedon Apr 15, 2022
I see the idea, but I wonder if we should have a broader “defaults” feature. For example,
base-uriis a weird one. It by default allows any URI, and does not respectdefault-src. So maybe in that spirit we want to provide abase-uriwith a default unless specifically stated, orOPT_OUTor something along those lines.