Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Content Security Policy for self subdomains

Tags:

http

security

In order to set a default-src for self it will exclude the subdomains of the origin website.

default-src 'self' 

How to enable the subdomains of the self URL?

like image 868
elkebirmed Avatar asked Feb 14 '16 10:02

elkebirmed


People also ask

Does CSP self include subdomains?

Bookmark this question. Show activity on this post. In order to set a default-src for self it will exclude the subdomains of the origin website.

What is Self in content security policy?

You might take 'self' to mean localhost, local filesystem, or anything on the same host. It doesn't mean any of those. It means sources that have the same scheme (protocol), same host, and same port as the file the content policy is defined in.

Do subdomains need to be registered?

Simple answer: No, you do not need to register a separate domain name for your subdomain. Depending on your domain name provider, there will be options to create additional subdomains.


1 Answers

You need to explicitly add them with fully qualified domains:

default-src 'self' sub1.example.com sub2.example.com 

Or with wildcards:

default-src 'self' *.example.com 
like image 108
Barry Pollard Avatar answered Oct 12 '22 22:10

Barry Pollard