I’ve been doing some work on CSP’s to make sure my Observatory scores are nice and high. These are pretty basic notes but the documentation is weird for this and it took me longer than it should have.

There’s a couple things more than the MDN docs I’ve learnt along the way. As a bunch of this doesn’t seem to be easily found together in documentation.

Gatsby

Start with the gatsby-plugin-csp but then also add the gatsby-plugin-netlify

The way Gatsby deals with images there is no way to get inlines out of the CSP

WordPress

Theres a little problem here with having inline scripts makes the CSP considerably weaker but that’s also how the editor works so I’ve been adding what I can to the .htaccess file and then some more through the meta tag in the themes header.php file

.htaccess file

The CSP needs to be wrapped in this if statement

<IfModule mod_headers.c>
    Content-Security-Policy "default-src 'self';
</IfModule>

multi line blocks need line breaks with slashes like these that are not needed in the meta tag

Header set Content-Security-Policy: "default-src 'self'; \
style-src 'self' 'unsafe-inline'; \
font-src 'self' ;"

Jetpack

When dealing with a theme using jetpack theres an inline script on every page that’s easy to grab and throw the hash into the script-src on either Edge or Chrome writing it out for you in the console.

Reports

In the .htaccess file add the line

report-uri /csp-violation-report-endpoint.php

This is referencing the root of the site beside the .htaccess file I’ve been adapting on the file here


Explore Content Security Policy

I’m playing around with YouTube formats, this week we split apart the snowboarding and the skiing from Snowbasin to see if that helps or hinders views, in theory each ep is a little less impressive but more targeted.


Explore Snowbasin Snowboard

I’m kinda getting used to being in-front of the camera, it’s still weird and I’d rather let someone else do it but with the deadlines and this year and it’s just easier to get some of the dialogue for these. Also really happy with the cable cam shots later in this ep, new setup for me and I’m going to try and do more with it.


Explore Tahoe Panic Button // Seeking Snowledge