First go at a Content Security Policy

 I had a first go at a 'Content Security Policy' (CSP).

I added HTTP headers to the '.htaccess' file on my website:

    Header add Content-Security-Policy "default-src 

    'unsafe-inline' https://bbingo.xyz data:;"

    'Header add Access-Control-Allow-Origin "*"

I really need to put my styles and scripts in separate files. Allowing inline styles and scripts is unsafe, so I have to say 'unsafe-inline'. A workaround would be to put hashes of the scripts in the CSP headers. I say 'data:' as I have some SVGS's encoded inline in a data URL.

Content Security Policies are meant to stop cross-site scripting attacks and work by telling the browser to only use resources from specific locations.

My tips page is attached to my pages on Sourceforge so I need to allow access to the favicon and manifest which are on my website at 'bbingo.xyz'. So I include the second header .

There are more tips at: bbingo.xyz/t