ใณใณใใณใใปใญใฅใชใใฃใใชใทใผ (CSP) ใฏใใฏใญในใตใคใในใฏใชใใใฃใณใฐ (Cross-site_scripting) ใใใผใฟใคใณใธใงใฏใทใงใณๆปๆใชใฉใฎใใใชใ
็นๅฎใฎ็จฎ้กใฎๆปๆใๆค็ฅใใๅฝฑ้ฟใ่ปฝๆธใใใใใซ่ฟฝๅ ใงใใใปใญใฅใชใใฃใฌใคใคใผใงใใใใใใฎๆปๆใฏใใผใฟใฎ็ชๅใใใตใคใใฎๆนใใใใใซใฆใงใขใฎๆกๆฃใซ่ณใใพใงใๆงใ ใช็ฎ็ใซ็จใใใใพใใ
- ็นๅฎใฎ็จฎ้กใฎๆปๆใๆค็ฅใใๅฝฑ้ฟใ่ปฝๆธใใใใใซ่ฟฝๅ ใงใใใปใญใฅใชใใฃใฌใคใคใผ
CSP ใฏๅฎๅ จใชๅพๆนไบๆๆงใไฟใฃใฆ่จญ่จใใใฆใใพใ๏ผใใ ใใ CSP 2 ใซใคใใฆใฏๅพๆนไบๆๆงใใชใ็นใใใใๆ็คบ็ใซ่จ่ฟฐใใใฆใใพใใ่ฉณ็ดฐใฏใใกใใฎ 1.1 ็ซ ใๅ็ งใใฆใใ ใใ๏ผใ
CSP ใซๅฏพๅฟใใฆใใชใใใฉใฆใถใผใฏ CSP ใ็ก่ฆใใ้ๅธธ้ใๆฉ่ฝใใพใใCSP ใ่ฟฝๅ ใใใใใชใใใชใๅถ้ใฏใชใใๆจๆบใฎๅไธใชใชใธใณใใชใทใผใฎไฟ่ญทใฎใฟใ้ฉ็จใใใพใใ
- CSP ใซๅฏพๅฟใใฆใใชใใใฉใฆใถใผใฏ CSP ใ็ก่ฆใใ้ๅธธ้ใๆฉ่ฝใซใชใ
CSP ใๆๅนใซใใใซใฏใ
ใฆใงใใตใผใใผใใ Content-Security-Policy HTTP ใใใใผใ่ฟใใใใซ่จญๅฎใใๅฟ ่ฆใใใใพใ๏ผX-Content-Security-Policy ใใใใผใซ้ขใใ่จ่ฟฐใๆใ ใใใพใใใใใใฏๅคใใใผใธใงใณใฎใใฎใงใใใไปๆฅใใฎใใใใผใๆๅฎใใๅฟ ่ฆใฏใใใพใใ๏ผใ
- ใใฎใใใใผใๆๅฎใใๅฟ ่ฆใฏใใใพใใ
- WEBใตใผใใผใซ้ข้ฃใใ
ใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใปใใใใผใไฝฟ็จใใใจใ
ๅพๆฅญๅกใฎใใใใซใชใฏใจในใๅฏ่ฝใชใชใฝใผในใ้็บ่ ใๅถๅพกใงใใใฎใงใใณใณใใณใใปใคใณใธใงใฏใทใงใณใฎใชในใฏใ่ปฝๆธใใใพใใใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใจใฏใ
Webใขใใชใฑใผใทใงใณใฎใฏใฉใคใขใณใๅดใชใฝใผใน็จใซJavaScriptใCSSใใคใกใผใธใชใฉใฎใฝใผในใปใใฏใคใใชในใใไฝๆใงใใใใใฉใฆใถๅดใฎใกใซใใบใใงใใใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใฏใใใฎใใใชใฝใผในใใใฎใชใฝใผในใฎใฟใๅฎ่กใพใใฏใฌใณใใชใณใฐใใใใใซใ็นๅฅใชHTTPใใใใผใไฝฟ็จใใฆใใฉใฆใถใซๆ็คบใใพใใ
- ใฝใผในใใใฎใชใฝใผในใฎใฟใๅฎ่กใพใใฏใฌใณใใชใณใฐใใใใใซใ็นๅฅใชHTTPใใใใผใไฝฟ็จใใฆใใฉใฆใถใซๆ็คบ
index.htmlใซ่จ่ผใใใฆใใ
ใในใฆใฎๅค้จใชใฝใผในใฎใใกใCSPใซ้ๅใใฆใใชใใชใฝใผในใฎใฟ่ชญใฟ่พผใฟใจๅฎ่กใ่กใใใพใใไธใฎ็ปๅใฎไพใงใฏใimg-src โselfโใจๆๅฎใใใฆใใใใใๅไธใชใชใธใณใใใฎ็ปๅใชใฝใผในใฎใฟ่จฑๅฏใใใhttps://bbb.com/BBB.jpg ใฎ่ชญใฟ่พผใฟใฏๆๅฆใใใพใใ
ใพใใscript-src nonce-xxxxใจๆๅฎใใใฆใใใใใnonceๅค๏ผโปnonceใฎ่ฉณ็ดฐใฏๅพ่ฟฐ๏ผใไธ่ดใใccc.jsใฏในใฏใชใใใๅฎ่กใใใพใใใddd.js ใฏnonceๅคใใชใCSP้ๅใจใชใใใๅฎ่กใใใพใใใ
โปไปฎใซinlineใงในใฏใชใใใ่จ่ผใใใฆใใฆใใCSP้ๅใฎๅ ดๅใฏๅฎ่กใฏใใใพใใใ
WebใตใผใใผใฏใใจใณใใปใฆใผใถใผใฎWebใขใใชใฑใผใทใงใณใในใฟใคใซใทใผใใใคใกใผใธใชใฉใใญใผใใงใใใใกใคใณใฎใชในใใๆๆกใใฆใใชใใใใใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใๅฎ่ฃ ใใใฎใฏไธๅฏ่ฝใงใใWebใตใผใใผใฏใใขใใชใฑใผใทใงใณใใใฉใฐใคใณใใกใใฃใขใชใฉใไฝฟ็จใใใใฉใใใใใใใใใญใผใใงใใใใฉใใใๆๆกใใฆใใพใใใ
ใชใฉใฏใซ็คพใงใฏใใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใปใใใใผใไฝฟ็จใใฆใใขใใชใฑใผใทใงใณ็นๆงใซๅบใฅใใใชใทใผใๅฎ็พฉใใใณๅฎ่ฃ ใใใใจใใ่ฆใใใฆใใพใใ
ใณใณใใณใใปใปใญใฅใชใใฃใปใใชใทใผใปใซใผใซใฎไฝฟ็จไพใๆฌกใซ็คบใใพใ:
ไพ: ใซใผใซ1
Content-Security-Policy: default-src 'self'ใใใฏๅถ้็ใชใซใผใซใงใใใๆฌกใฎใใใชใขใใชใฑใผใทใงใณใงๆฉ่ฝใใพใ:
ใในใฆใฎใชใฝใผในใใๆๅฎใใใใผใธใฎๅใใใกใคใณใงใในใใใใพใใ
ในใฏใชใใใใใณในใฟใคใซใปใชใฝใผในใซๅฏพใใใคใณใฉใคใณใพใใฏ่ฉไพกใใใใพใใใ
ไพ: ใซใผใซ2
Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';ใใฎใใชใทใผใฎๅ ๅฎน:
ใชใใธใงใฏใใใใฌใผใ ใใกใใฃใขใชใฉใฎใชใฝใผในใฎใญใผใใ่จฑๅฏใใพใใใ
ๅใ่ตท็นใใใฎใคใกใผใธใในใฏใชใใใAJAXใใใณCSSใ่จฑๅฏใใพใใ
ไพ: ใซใผใซ3
Content-Security-Policy: frame-ancestors self;
ๆๆณ
่ชฌๆใธใฎ็่งฃใ้ฃใใใ
ใใใฏๅคใใใผใธใงใณใฎใใฎใงใใใไปๆฅใใฎใใใใผใๆๅฎใใๅฟ
่ฆใฏใใใพใใใจๆธใใฆใใๅฟ
่ฆใชใฎใๅฟ
่ฆใใใชใใฎใใใใใชใใฃใใ
ใฉใ่จใๅ้ใ็ฅใฃใฆใใใฐ็่งฃใงใใใฎใ๏ผ
Comments
Let's comment your feelings that are more than good