New answers tagged security
2
Relying on the user agent is not reliable - for example I changed the user agent in my old browser, otherwise YouTube refuses to work. If, based on the results of the analysis of the violation reports, you change the CSP for such of my user agent, legitimate users of this browser may suffer.
Using of script-src-attr 'unsafe-inline'; will open door for XSS ...
3
Drupal 7 only limits the length of the host name to 1000 bytes to prevent DoS attacks, and it doesn't accepts host names containing slashes, but it doesn't restrict the allowed host names basing on a value set in the settings.php file, as Drupal 8 and Drupal 9 do.
The code checking the value of the HTTP_HOST header is contained in drupal_valid_http_host().
//...
1
Trusted host patterns were introduced in Drupal 8. There's nothing to configure for Drupal 7.
Top 50 recent answers are included