Content-Security-Policy

这篇翻译不完整。请帮忙从英语翻译这篇文章

}
HTTP 响应头 Content-Security-Policy 允许站点管理者在指定的页面控制用户代理的资源。除了少数例外,这条政策将极大地指定服务源 以及脚本端点。这将帮助防止跨站脚本攻击(Cross-Site Script) (XSS).

更多信息,请查阅 Content Security Policy (CSP).

Header type Response header
Forbidden header name no

概述

Content-Security-Policy: <policy-directive>; <policy-directive>

指令

取指令Fetch directives(其实叫源控制指令会更好一点)

通过取指令来控制某些可能被加载的资源类型的位置。

child-src
child-src:web workers和其他内嵌浏览器内容定义 合法的源,例如用<frame><iframe>加载到页面的内容。
connect-src
connect-src:限制能通过脚本接口加载的URL。
default-src
default-src:为其他取指令提供备用服务fetch directives.
font-src
font-src:限制通过@font-face加载的字体源。
frame-src
frame-src: 限制通过类似<frame><iframe> 标签加载的内嵌内容源。
img-src
img-src: 限制图片和图标源
manifest-src
manifest-src : 限制 application manifest 文件源。
media-src
media-src:限制通过<audio><video> 标签加载的媒体文件源。
object-src
object-src:限制通过  <object>, <embed><applet> 标签加载源。
script-src
script-src:限制javascript 源。
style-src
style-src:限制层叠样式表文件源。
worker-src
worker-src:限制Worker, SharedWorker, 或者 ServiceWorker脚本源。

文档指令Document directives

文档指令管理文档属性或者工作环境应用哪个策略。

base-uri
base-uri: 限制在DOM中使用base 标签 的URL
plugin-types
plugin-types: 限制一系列可以通过一些限制类型的资源加载内嵌到DOM的插件。
sandbox
sandbox: 允许类似{HTMLElement("iframe")}} sandbox sandbox 属性,
disown-opener
确保资源在操作的时候能够脱离父页面。(windown.opener 对象)Ensures a resource will disown its opener when navigated to.

导航指令 Navigation directives

导航指令管理用户能打开的链接或者表单可提交的链接

form-action
限制能被用来作为给定上下文的表单提交的 目标 URL  (说白了,就是限制 form 的 action 属性的链接地址)
frame-ancestors
指定可能嵌入页面的有效父项<frame><iframe><object><embed>, or <applet>.
navigation-to
限制文档可以通过以下任何方式访问URL (a, form, window.location, window.open, etc.)

报告指令

报告指令控制 CSP违规的报告过程. 更多请看 Content-Security-Policy-Report-Only 报头.

report-uri
Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.
report-to
Fires a SecurityPolicyViolationEvent.

Other directives

block-all-mixed-content
当使用HTTPS加载页面时组织使用HTTP加载任何资源。
referrer
Used to specify information in the referer (sic) header for links away from a page. Use the Referrer-Policy header instead.
require-sri-for
需要使用 SRI 作用于页面上的脚本或样式。
upgrade-insecure-requests
Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

CSP 和 Workers

Workers 一般来说不被创建他的文档(或者父级Worker)的CSP策略管理。如果要为Worker指定CSP策略,可以为Worker脚本的请求的响应的头部设置CSP策略。 

例外的情况是,如果Worker脚本的来源是一个全局唯一ID(比如,它的URL是一个结构化的数据或者BLOB)。在这种情况下,这个Worker会继承它所属的文档或者创建它的Worker的CSP策略。

多内容安全策略

CSP allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a <meta> element.

You can use the Content-Security-Policy header more than once like in the example below. Pay special attention to the connect-src directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none' is enforced.

Content-Security-Policy: default-src 'self' http://example.com;
                         connect-src 'none';
Content-Security-Policy: connect-src http://example.com/;
                         script-src http://example.com/

示例

示例: 禁用不安全的内联/动态执行, 只允许通过 https加载这些资源 (images, fonts, scripts, etc.)

// header
Content-Security-Policy: default-src https:

// meta tag
<meta http-equiv="Content-Security-Policy" content="default-src https:">

示例: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins:

Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'

Example: Don't implement the above policy yet; instead just report violations that would have occurred:

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

查看 Mozilla Web Security Guidelines 上的更多例子.

规范

规范 状态 注释
Content Security Policy Level 3 Editor's Draft Adds disown-opener, manifest-src, navigation-to, report-uri, strict-dynamic, worker-src. Undeprecates frame-src. Deprecates report-uri in favor if report-to.
Mixed Content Candidate Recommendation Adds block-all-mixed-content.
Subresource Integrity Recommendation Adds require-sri-for.
Upgrade Insecure Requests Candidate Recommendation Adds upgrade-insecure-requests.
Content Security Policy Level 2 Recommendation Adds base-uri, child-src, form-action, frame-ancestors, plugin-types, referrer, reflected-xss, and report-uri. Deprecates frame-src.
Content Security Policy 1.0 Candidate Recommendation Defines connect-src, default-src, font-src, frame-src, img-src, media-src, object-src, report-uri, sandbox, script-src, and style-src.

浏览器兼容性

No compatibility data found. Please contribute data for "http/headers/content-security-policy" (depth: Content-Security-Policy) to the MDN compatibility data repository.

参见

<weel class="_on" data-api-src="google" data-check-aim="false" data-lang-from="en" data-lang-to="zh" id="weel__float-action-button" style="visibility: hidden; opacity: 0; transform: translate3d(57px, 5195px, 0px);"><weel id="weel__float-action-button--container"><weel id="weel__float-action-button--icon"></weel></weel></weel><weel class="_reverse _on" id="weel__float-action-panel" style="visibility: hidden; opacity: 0; transform: translate3d(53.925px, 5033.5px, 0px);"><weel id="weel__float-action-panel--container" style="left: -12px;"><weel id="weel__float-action-panel--output-stream"><weel id="weel__float-action-panel--output-stream-result"><weel id="weel__float-action-panel--output-stream-result-word"><weel id="weel__float-action-panel--output-stream-phonetic"><weel id="weel__float-action-panel--i-voice"></weel><weel id="weel__float-action-panel--output-stream-phonetic-plain">[ ... ]</weel></weel><weel id="weel__float-action-panel--output-stream-explain"><weel id="weel__float-action-panel--i-copy"></weel><weel id="weel__float-action-panel--output-stream-explain-plain">也可以看看</weel><weel class="_on" id="weel__float-action-panel--output-stream-explain-detail">参见
参看</weel></weel></weel></weel></weel></weel></weel>

文档标签和贡献者

 此页面的贡献者: crper, lcw0622, SuunZhu
 最后编辑者: crper,