Comments (3)
Hey @Garbee! Thanks for the suggestion. I think we definitely want to consider these kinds of rules alongside other security ones (like serving on TLS, for example).
So this audit would look for unsafe-eval
and unsafe-inline
, right? Noodling here over whether there are other things CSP-related that would be worth folding in. I'm no CSP boffin, though, so suggestions welcome!
from lighthouse.
Yup, those are the two unsafe rules. The only other two things possible are wildcards *
in a domain, since they allow any given subdomain to send content. Then there is deprecated rules such as frame-src
.
I'm working on a patch to the DevTools Sec Panel with this kind of parsing. But, this tool provides another opportunity to get this information in front of developers. If you want a full parser that functions in most cases 😉 is in this CR. The third_party/WebKit/Source/devtools/front_end/sdk/CSPParser.js
file.
from lighthouse.
Ideally, I'd like to defer to what lands in CSPParser and the warnings surfaced in DevTools.
We can use that easily in Lighthouse once its in place.
In the meantime I've added an entry to goto.google.com/lighthouse-rules for CSP to track this. I'll close the issue as it's not in the immediate milestone for lighthouse
from lighthouse.
Related Issues (20)
- Unexpected changes in main thread time reported around March 8th HOT 8
- Sequential network requests are simulated as parallel and the first rtt is ignored
- Lone surrogate character breaks PSI proto conversion HOT 4
- Was filing bug report when site crashed multiple before I could get the first report in HOT 2
- On certain audited pages, `totalBodyElements` are different from `MainDocumentContent` body nodes count HOT 1
- The Future of WordPress in the Age of AI Integration HOT 2
- Site security issues while making payment to Comcast. HOT 1
- SEO updates from recent search conversations
- Unexpected changes on main thread work from 11.6.0 to 11.7.1 HOT 3
- Viewport resizing to window size
- Lighthouse LCP Issue HOT 1
- LCP not recognized in many pages for this site. HOT 1
- Print stylesheet picked for Render-blocking resource HOT 1
- Incorrect user agent on pagespeed.web.dev HOT 1
- Protocol error (Target.getTargetInfo): Protocol error (Target.getTargetInfo): 'Target.getTargetInfo' wasn't found HOT 3
- Keep passing Core Web Vitals but failing LCP
- "Opportunities" no longer surfaced in report or in resulting output in Lighthouse 12 HOT 5
- CPU throttling is unstable
- Testing Page metrics for different HTTP versions HOT 1
- LH:ChromeLauncher Waiting for browser
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lighthouse.