118
edits
Security/CSP/XSSModule: Difference between revisions
no edit summary
No edit summary |
No edit summary |
||
| Line 20: | Line 20: | ||
An HTTP server can deliver a policy to the browser by including a header named X-Content-Security-Policy. The general X-Content-Security-Policy header as the following syntax: | An HTTP server can deliver a policy to the browser by including a header named X-Content-Security-Policy. The general X-Content-Security-Policy header as the following syntax: | ||
<pre>content-security-policy = "x-content-security-policy" ":" OWS csp- | <pre>content-security-policy = "x-content-security-policy" ":" OWS csp-policy OWS | ||
csp- | csp-policy = csp-rule ["," csp-policy] | ||
csp-rule = future-rule / known-rule | csp-rule = future-rule / known-rule | ||
future-rule = (anything but ";") | future-rule = (anything but ";") | ||