mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

doc: add CSP examples (#13167)

Browse source 
* doc: add CSP examples

* Deafult to zero-permissions CSP
This commit is contained in:
Zeke Sikelianos 2018-06-19 17:36:37 -07:00 • committed by Samuel Attard
parent fc12b5cab3
commit 0802f82356
1 changed files with 27 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

33
docs/tutorial/security.md
View file

@ -339,12 +339,7 @@ CSP allows the server serving content to restrict and control the resources
Electron can load for that given web page. `https://your-page.com` should Electron can load for that given web page. `https://your-page.com` should
be allowed to load scripts from the origins you defined while scripts from be allowed to load scripts from the origins you defined while scripts from
`https://evil.attacker.com` should not be allowed to run. Defining a CSP is an `https://evil.attacker.com` should not be allowed to run. Defining a CSP is an
easy way to improve your applications security. easy way to improve your application's security.
### How?
Electron respects [the `Content-Security-Policy` HTTP header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
and the respective `<meta>` tag.
The following CSP will allow Electron to execute scripts from the current The following CSP will allow Electron to execute scripts from the current
website and from `apis.mydomain.com`. website and from `apis.mydomain.com`.
@ -357,6 +352,32 @@ Content-Security-Policy: '*'
Content-Security-Policy: script-src 'self' https://apis.mydomain.com Content-Security-Policy: script-src 'self' https://apis.mydomain.com
``` ```
### CSP HTTP Header
Electron respects the [`Content-Security-Policy` HTTP header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
which can be set using Electron's
[`webRequest.onHeadersReceived`](../api/web-request.md#webrequestonheadersreceivedfilter-listener)
handler:
```javascript
const {session} = require('electron')
session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
callback({responseHeaders: `default-src 'none'`})
})
```
### CSP Meta Tag
CSP's preferred delivery mechanism is an HTTP header. It can be useful, however,
to set a policy on a page directly in the markup using a `<meta>` tag:
```html
<meta http-equiv="Content-Security-Policy" content="default-src 'none'">
```
#### `webRequest.onHeadersReceived([filter, ]listener)`
## 7) Override and Disable `eval` ## 7) Override and Disable `eval`