5 min readUpdated
Browsers report broken security policies, deprecated APIs, failed requests and crashes through the same API as CSP. What each type tells you, and how to keep the noisy ones affordable.
5 min readUpdated
We wrap our servers in layer after layer of controls, then ship the same code to a machine we do not run and add almost nothing. What the browser layer is, and how to start it.
7 min readUpdated
In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.
6 min read
Card skimmers arrive as a new script, a modified one, an inline handler or a fake payment form, and send data to lookalike hosts. Which CSP report each variant produces, and which produce none.
4 min readUpdated
Add 'report-sha256' to a Content-Security-Policy and Chrome and Edge send a hash of each script they fetch. How to set it up, what the report contains, and where it helps.
5 min read
A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.
5 min read
For 15 days in 2018, 22 lines added to a script on ba.com copied card details to baways.com. The connect-src report that names a host like that on its first request, and what CSP leaves unsolved.
4 min readUpdated
Browser extensions, crawlers and data: URIs trigger CSP violation reports your site didn't cause. How HeaderHawk identifies that noise and keeps it out of your alerts.