Skip to main content
Drupal Answers

Return to Question

added 53 characters in body; edited title
Source Link
berliner
berliner
  • 2.9k
  • 1
  • 21
  • 29

Is it a valid approach to have a different CSP for logged-inbased on login state and anonymous usersbrowser?

  • Drupal 8, with a custom patch that makes ckeditor.js pass on nonces when loading it's plugins, CKEditor only being used by logged in users
  • Security KitSecurity Kit, patched to provide an alter hook for the CSP directives (https://www.drupal.org/project/seckit/issues/2844205#comment-14217383).
  • Custom code to make modifications to the rendered HTML and to the CSP configuration from the Security Kit module

Is it a valid approach to have a different CSP for logged-in and anonymous users?

  • Drupal 8, with a custom patch that makes ckeditor.js pass on nonces when loading it's plugins, CKEditor only being used by logged in users
  • Security Kit, patched to provide an alter hook for the CSP directives (https://www.drupal.org/project/seckit/issues/2844205#comment-14217383).
  • Custom code to make modifications to the rendered HTML and to the CSP configuration from the Security Kit module

Is it a valid approach to have a different CSP based on login state and browser?

Added back the security tag, it's covered by https://drupal.stackexchange.com/tags/security/info as far as I see, also add back the numbered questions as they are different to me and I'm looking for an answer to both.
Source Link
berliner
berliner
  • 2.9k
  • 1
  • 21
  • 29

Is it a valid approach to have a different CSP for logged-in and anonymous users, or for different "reported browsers"?:

  1. different CSPs for logged-in vs anonymous users?
  2. different CSPs for different browsers (or different "reported browsers" actually)?

Is it a valid approach to have a different CSP for logged-in and anonymous users, or for different "reported browsers"?

Is it a valid approach to have:

  1. different CSPs for logged-in vs anonymous users?
  2. different CSPs for different browsers (or different "reported browsers" actually)?
removed "Drupal" and tags from the title
Source Link
avpaderno ♦
avpaderno ♦
  • 97.9k
  • 15
  • 164
  • 284

Content Security Policy in Drupal 8, implementation question Is it a valid approach to have a different CSP for logged-in and anonymous users?

Does that make sense asIs it a generalvalid approach? Or is it flawed in to have a way that I start over from the beginningdifferent CSP for logged-in and anonymous users, or for different "reported browsers"?

Main questions:

  1. Is it a valid approach to have a different CSP for logged-in vs anonymous users?
  2. Is it a valid approach to have different CSPs for different browsers (or different "reported browsers" actually)?

Content Security Policy in Drupal 8, implementation question

Does that make sense as a general approach? Or is it flawed in a way that I start over from the beginning?

Main questions:

  1. Is it a valid approach to have a different CSP for logged-in vs anonymous users?
  2. Is it a valid approach to have different CSPs for different browsers (or different "reported browsers" actually)?

Is it a valid approach to have a different CSP for logged-in and anonymous users?

Is it a valid approach to have a different CSP for logged-in and anonymous users, or for different "reported browsers"?

Source Link
berliner
berliner
  • 2.9k
  • 1
  • 21
  • 29