Add Content Security Policy (CSP) to enhance security #1118
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* add: patrick * Update public/data/developer_assets.json Co-authored-by: Shyam Tawli <[email protected]> --------- Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
* Added my profile (https://github.com/Erick-WG) * add: Erick-WG * Delete .vscode/settings.json * Update ProfilesList.json --------- Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
* add: Ag-neta * add: Ag-neta
Co-authored-by: Shyam Tawli <[email protected]>
* add: Atharv Dalal * Update ProfilesList.json
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Eman Ali Abbasi <[email protected]>
* Added profile * Update package-lock.json
* Create Sahilll15.json * Update ProfilesList.json * Update Sahilll15.json Co-authored-by: Shyam Tawli <[email protected]> --------- Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
…yamtawli#990 (shyamtawli#1029) * make skill section on user profile responsive * update * make skill section responsive * update * update * resolve conflit
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
* ankit mourya * ankit mourya change style * change in contact us and deleted pakage
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
* Update App.js * Update Search.jsx * fixed search issue * improve ui --------- Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
* Added Sai Pradyumna Goud Chiragoni * Updated ProfilesList.json --------- Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: grappo <[email protected]> Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
Co-authored-by: Shyam Tawli <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Great job, @usernayeem! 🎉 Thank you for opening a pull request. Your contribution is valuable and we appreciate your efforts to improve our project.
Soon the maintainers/owner will review it and provide you with feedback/suggestions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This pull request introduces a Content Security Policy (CSP) to the devFind application. The CSP is designed to enhance the security of the application by restricting the sources from which content can be loaded. This helps to reduce the risk of cross-site scripting (XSS) and other injection attacks.
Related Issues
#1117
Changes Proposed
default-src 'none';: Disallows all content by default.script-src 'self' 'unsafe-inline';: Allows scripts only from the same origin and inline scripts.style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;: Permits styles from the same origin, inline styles, and Google Fonts.font-src 'self' https://fonts.gstatic.com;: Restricts font loading to the same origin and Google Fonts.img-src 'self' https://github.com/ https://avatars.githubusercontent.com/ https://pbs.twimg.com;: Allows images from the same origin, GitHub, and Twitter.manifest-src 'self';: Restricts the web app manifest to the same origin.connect-src 'self';: Limits network connections to the same origin.base-uri 'self';: Ensures that the base URL is restricted to the same origin.form-action 'self';: Restricts form submissions to the same origin.Checklist
Screenshots
Note to reviewers
Please review the CSP configuration to ensure it does not inadvertently block legitimate content. Testing across various environments is recommended to verify that all functionality remains intact while enhancing security.