OLD | NEW |
1 <h1>Comply with CSP</h1> | 1 <h1>Comply with CSP</h1> |
2 | 2 |
3 | 3 |
4 <p> | 4 <p> |
5 If you're unfamiliar with Content Security Policy (CSP), | 5 If you're unfamiliar with Content Security Policy (CSP), |
6 <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy
/">An Introduction to Content Security Policy</a> | 6 <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy
/">An Introduction to Content Security Policy</a> |
7 is a good starting point. | 7 is a good starting point. |
8 It covers the broader web platform view of CSP; | 8 It covers the broader web platform view of CSP; |
9 packaged apps CSP isn't as flexible. | 9 packaged apps CSP isn't as flexible. |
10 You should read the | 10 You should read the |
11 <a href="http://code.google.com/chrome/extensions/contentSecurityPolicy.html">Ch
rome extension Content Security Policy</a> | 11 <a href="/extensions/contentSecurityPolicy.html">Chrome extension Content Securi
ty Policy</a> |
12 as it's the foundation for the packaged app CSP. | 12 as it's the foundation for the packaged app CSP. |
13 For brevity's sake, | 13 For brevity's sake, |
14 we don't repeat the same information here. | 14 we don't repeat the same information here. |
15 </p> | 15 </p> |
16 | 16 |
17 <p> | 17 <p> |
18 CSP is a policy to mitigate against cross-site scripting issues, | 18 CSP is a policy to mitigate against cross-site scripting issues, |
19 and we all know that cross-scripting is bad. | 19 and we all know that cross-scripting is bad. |
20 We aren’t going to try and convince you | 20 We aren’t going to try and convince you |
21 that CSP is a warm-and-fuzzy new policy. | 21 that CSP is a warm-and-fuzzy new policy. |
(...skipping 95 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
117 | 117 |
118 <h3 id="embed_content">Embed web content</h3> | 118 <h3 id="embed_content">Embed web content</h3> |
119 | 119 |
120 <p> | 120 <p> |
121 Instead of using an iframe, | 121 Instead of using an iframe, |
122 you can call out to an external URL using an object tag | 122 you can call out to an external URL using an object tag |
123 (see <a href="app_external.html#webview">Embed external web pages</a>). | 123 (see <a href="app_external.html#webview">Embed external web pages</a>). |
124 </p> | 124 </p> |
125 | 125 |
126 <p class="backtotop"><a href="#top">Back to top</a></p> | 126 <p class="backtotop"><a href="#top">Back to top</a></p> |
OLD | NEW |