Security HTTP Headers helps your website from attacks such as Clickjacking, code injection, MIME types, Cross Site Scripting (XSS), etc. A typical attack can take place when you include Javascript from a Third-Party Site. If somehow the Javascript from the domain/site you are including in your website is compromized, the script may try to send data/load data from attackersite.com.
These scripts may request access to hardware components available via web browser such as Camera, Microphone, Location, Motion Sensors, etc , voiding the security of users using the site.
Zeit/Vercel supports adding Custom Headers to deployments by adding it as a list of header definitions in now.json
Header object definition:
source: A pattern that matches each incoming pathname (excluding querystring).headers: An array of key/value pairs representing each response header.example now.json
| |
If you are using external domains to include CSS / JS into,
{
"headers": {
...
"Content-Security-Policy": "... style-src 'self' 'unsafe-inline' cdn.domain.com; ... "
...
}
}
{
"headers": {
...
"Content-Security-Policy": "... script-src 'self' cdn.domain.com ... "
...
}
}
.css and .jsAfter applying the above now.json you may notice that scripts are blocked with a bare bones CSP
You can see the error message in Web-Dev tools -> Console.
Copy SHA-256 hash in that error message and change the CSP to do this, make sure these hashed are in between single quotes 'sha256-blablah='
{
"headers": {
...
"Content-Security-Policy": "... script-src 'self' cdn.domain.com 'sha256-blablah=' ... "
...
}
}
Here we rely on the filesystem, providing a custom error page if there are no matches, precedence is given to the filesystem, routing only to /404 if there is no match.
In now.json add the following
{
"version": 2,
"builds": [{ "src": "package.json", "use": "@now/static-build" }],
"routes": [
{
"src": "/(.*)",
"dest": "/$1"
},
{ "handle": "filesystem" },
{
"src": "/.*",
"status": 404,
"dest": "/404.html"
}
]
}
Visit https://securityheaders.com/ to analyze your site.
now.json may look like | |
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。