Then you need to detect CDN's that actually serve your content. Images and such.... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

angry-hacker on Jan 26, 2016 | parent | context | favorite | on: Updated Firefox Security Indicators

Then you need to detect CDN's that actually serve your content. Images and such. They can also come from your subdomain(s) of course. Maybe you could whitelist the subdomains only.

nailer on Jan 26, 2016 [–]

> Maybe you could whitelist the subdomains only.

https://www.npmjs.com/package/csp-by-api can help with that: it contains CSPs for popular APIs so you can just add the the APIs you're using to your own CSP:

    var policy = cspByAPI(basePolicy, ['twitter', 'mixpanel', 'googleFonts', 'stripe', 'typekit', 'ractive'])

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact