Implementing Mozilla’s Content Security Policy
I recently discovered this page, which describes Mozilla’s solution for prevention of XSS (Cross-Site Scripting) available as a Firefox Extension. Here’s the HTTP response from my site: hank@tardis:~$ wget -S http://www.ralree.com –2009-06-30 09:52:13– http://www.ralree.com/ Resolving www.ralree.com… 74.54.115.108 Connecting to www.ralree.com|74.54.115.108|:80… connected. HTTP request sent, awaiting response… HTTP/1.1 200 OK Date: Tue, 30 Jun 2009 13:49:54 GMT Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.7a Phusion_Passenger/2.1.3 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.8 X-Pingback: http://www.ralree.com/newblog/xmlrpc.php Last-Modified: Tue, 30 Jun 2009 13:49:21 GMT X-Content-Security-Policy: allow self; img-src [...]

