view release on metacpan or  search on metacpan

lib/HTTP/Promise/Headers/ContentSecurityPolicy.pm  view on Meta::CPAN

    Content-Security-Policy: require-sri-for script;
    Content-Security-Policy: require-sri-for style;
    Content-Security-Policy: require-sri-for script style;

=head2 require_trusted_types_for

Enforces Trusted Types at the DOM XSS injection sinks.

Example:

    Content-Security-Policy: require-trusted-types-for 'script';

=head2 sandbox

Enables a sandbox for the requested resource similar to the C<iframe> sandbox attribute.

This can be set as a boolean or with a string value:

    # This will add 'sandbox' (without surrounding quotes) as a property
    $h->sandbox(1);
    # Returns true.
    my $rv = $h->sandbox;
    $h->sandbox(0);
    # Returns false.
    my $rv = $h->sandbox;
    # Removes it
    $h->sandbox( undef );
    # Will set sandbox to 'allow-downloads' (without surrounding quotes)
    $h->sandbox( 'allow-downloads' );

It takes an optional value, such as:

=over 4

=item C<allow-downloads>

Allows for downloads after the user clicks a button or link.

=item C<allow-downloads-without-user-activation>

This is reportedly an experimental value.

Allows for downloads to occur without a gesture from the user.

=item C<allow-forms>

Allows the page to submit forms. If this keyword is not used, this operation is not allowed.

=item C<allow-modals>

Allows the page to open modal windows.

=item C<allow-orientation-lock>

Allows the page to disable the ability to lock the screen orientation.

=item C<allow-pointer-lock>

Allows the page to use the Pointer Lock API.

=item C<allow-popups>

Allows popups (like from window.open, target="_blank", showModalDialog). If this keyword is not used, that functionality will silently fail.

=item C<allow-popups-to-escape-sandbox>

Allows a sandboxed document to open new windows without forcing the sandboxing flags upon them. This will allow, for example, a third-party advertisement to be safely sandboxed without forcing the same restrictions upon the page the ad links to.

=item C<allow-presentation>

Allows embedders to have control over whether an iframe can start a presentation session.

=item C<allow-same-origin>

Allows the content to be treated as being from its normal origin. If this keyword is not used, the embedded content is treated as being from a unique origin.

=item C<allow-scripts>

Allows the page to run scripts (but not create pop-up windows). If this keyword is not used, this operation is not allowed.

=item C<allow-storage-access-by-user-activation>

This is reportedly an experimental value.

Lets the resource request access to the parent's storage capabilities with the Storage Access API.

=item C<allow-top-navigation>

Allows the page to navigate (load) content to the top-level browsing context. If this keyword is not used, this operation is not allowed.

=item C<allow-top-navigation-by-user-activation>

Lets the resource navigate the top-level browsing context, but only if initiated by a user gesture.

=back

Example:

    Content-Security-Policy: sandbox;
    Content-Security-Policy: sandbox allow-scripts;

=head2 script_src

Specifies valid sources for JavaScript.

Example:

    Content-Security-Policy: script-src https://example.com/
    Content-Security-Policy: script-src 'self' js.example.com;

=head2 script_src_elem

Specifies valid sources for JavaScript <script> elements.

Example:

    Content-Security-Policy: script-src-elem https://example.com/
    Content-Security-Policy: script-src-elem https://example.com/ https://dev.example.com/

=head2 script_src_attr

Specifies valid sources for JavaScript inline event handlers.

Example: