OLD | NEW |
1 <h1>Comply with CSP</h1> | 1 <h1>Comply with CSP</h1> |
2 | 2 |
3 | 3 |
4 <p> | 4 <p> |
5 If you're unfamiliar with Content Security Policy (CSP), | 5 If you're unfamiliar with Content Security Policy (CSP), |
6 <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy
/">An Introduction to Content Security Policy</a> | 6 <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy
/">An Introduction to Content Security Policy</a> |
7 is a good starting point. | 7 is a good starting point. |
8 It covers the broader web platform view of CSP; | 8 It covers the broader web platform view of CSP; |
9 packaged apps CSP isn't as flexible. | 9 packaged apps CSP isn't as flexible. |
10 You should read the | 10 You should read the |
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
76 | 76 |
77 <h2 id="but">"But then how do I..."</h2> | 77 <h2 id="but">"But then how do I..."</h2> |
78 | 78 |
79 <p> | 79 <p> |
80 It's very possible that you are using templating libraries | 80 It's very possible that you are using templating libraries |
81 and many of these won’t work with CSP. | 81 and many of these won’t work with CSP. |
82 You may also want to access external resources in your app | 82 You may also want to access external resources in your app |
83 (external images, content from websites). | 83 (external images, content from websites). |
84 </p> | 84 </p> |
85 | 85 |
86 <h3>Use templating libraries</h3> | 86 <h3 id="templating">Use templating libraries</h3> |
87 | 87 |
88 <p> | 88 <p> |
89 Use a library that offers precompiled templates | 89 Use a library that offers precompiled templates |
90 and you’re all set. | 90 and you’re all set. |
91 You can still use a library that doesn’t offer precompilation, | 91 You can still use a library that doesn’t offer precompilation, |
92 but it will require some work on your part and there are restrictions. | 92 but it will require some work on your part and there are restrictions. |
93 </p> | 93 </p> |
94 | 94 |
95 <p> | 95 <p> |
96 You will need to use sandboxing to isolate any content | 96 You will need to use sandboxing to isolate any content |
97 that you want to do ‘eval’ things to. | 97 that you want to do ‘eval’ things to. |
98 Sandboxing lifts CSP on the content that you specify. | 98 Sandboxing lifts CSP on the content that you specify. |
99 If you want to use the very powerful Chrome APIs in your packaged app, | 99 If you want to use the very powerful Chrome APIs in your packaged app, |
100 your sandboxed content can't directly interact with these APIs | 100 your sandboxed content can't directly interact with these APIs |
101 (see <a href="app_external.html#sandboxing">Sandbox local content</a>). | 101 (see <a href="app_external.html#sandboxing">Sandbox local content</a>). |
102 </p> | 102 </p> |
103 | 103 |
104 <h3>Access remote resources</h3> | 104 <h3 id="remote_resources">Access remote resources</h3> |
105 | 105 |
106 <p> | 106 <p> |
107 You can fetch remote resources via <code>XMLHttpRequest</code> | 107 You can fetch remote resources via <code>XMLHttpRequest</code> |
108 and serve them via <code>blob:</code>, <code>data:</code>, | 108 and serve them via <code>blob:</code>, <code>data:</code>, |
109 or <code>filesystem:</code> URLs | 109 or <code>filesystem:</code> URLs |
110 (see <a href="app_external.html#external">Referencing external resources</a>). | 110 (see <a href="app_external.html#external">Referencing external resources</a>). |
111 </p> | 111 </p> |
112 | 112 |
113 <p> | 113 <p> |
114 Video and audio can be loaded from remote services | 114 Video and audio can be loaded from remote services |
115 because they have good fallback behavior when offline or under spotty connectivi
ty. | 115 because they have good fallback behavior when offline or under spotty connectivi
ty. |
116 </p> | 116 </p> |
117 | 117 |
118 <h3>Embed web content</h3> | 118 <h3 id="embed_content">Embed web content</h3> |
119 | 119 |
120 <p> | 120 <p> |
121 Instead of using an iframe, | 121 Instead of using an iframe, |
122 you can call out to an external URL using an object tag | 122 you can call out to an external URL using an object tag |
123 (see <a href="app_external.html#objecttag">Embed external web pages</a>). | 123 (see <a href="app_external.html#objecttag">Embed external web pages</a>). |
124 </p> | 124 </p> |
125 | 125 |
126 <p class="backtotop"><a href="#top">Back to top</a></p> | 126 <p class="backtotop"><a href="#top">Back to top</a></p> |
OLD | NEW |