xtian
Plug_content_security_policy - Generate CSP headers with support for CSP Level 2 nonces
Hey everyone- I’ve released a new version of my library plug_content_security_policy, which aids in the generation of CSP headers for Plug/Phoenix applications.
Setting a Content Security Policy header for your application helps mitigate the risk of cross-site scripting and malicious asset injection by letting you control what sorts of requests are allowed from a page. See the link above for more info and examples.
Version 0.2 of PlugContentSecurityPolicy adds support for report-only mode, which you can use to test your policy for violations without breaking those requests on your site.
First Post!
erlangtest
Thank you so much for creating and open sourcing this.
-
Could you please include a small video walkthrough of the setup steps in a demo web app? I am trying to set it up and getting stuck while adding the module to pipeline.
-
Could you please elaborate if this module also adds the nonces to the script tag? Or does it just generate the nonces and you have to rewrite all the inline scripts to include the generated nonce?
I want all of my inline scripts to have following format
Popular in Announcing
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Enabling companies to succeed by building software people love.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Practical resources that improve the lives of professional developers.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"