Content security policy
Premium Certified Partner
Maintained by
Brendan Heywood, Catalyst IT
This plugin allows an admin to create a Custom Security Policy (CSP) in both reporting mode and enforcing mode. A simple use case is to detect and cleanup issues with non secure content after a migration from http to https, through to advanced policies to mitigate from XSS attacks.
Comments
Comments are no longer open for new posts. Existing comments remain available to read.
Close my post.
Let me have a question. I may mis-understand something.
--
I made this setting. It seems nice for testing cookies.
"HttpOnly;Secure;SameSite=Strict"
But it seems no effect for this value.
Set-Cookie: MoodleSession
The cookie is "secure; SameSite=None".
So, install the version from https://github.com/catalyst/moodle-local_csp. This https://moodle.org/plugins/local_csp page doesn't always have the latest version of the plugin.
https://github.com/catalyst/moodle-local_csp/issues/77
May I have the list of what CSP is supported in this plugin? Thank you.
Have you actually tested it in 3.3? I'd be surprised if it didn't work as-is in 3.3 but I haven't tested it myself. If there is any issues under 3.3 can you please raise them here https://github.com/catalyst/moodle-local_csp/issues
thanks
Does this plug-in work with IE-11?
I can block content in Chrome and FFox so far but same content not blocked in IE-11.
TIA!!
1. The https://github.com/moodlerooms/moodle-tool_httpsreplace reported a far greater number of potentially problematic domains than the CSP violation report did. I guess I'd have to dig around in the code to find out what each is doing exactly to determine why but if anyone has an idea about this that would be very helpful!
2. I generated a few pages of CSP violation reports, made some changes and reset all statistics. I think perhaps that was not the correct thing to do. Our system technically should be producing the same report it did initially but since I reset statistics I can't seem to find a way to make this happen. I've cleared caches and disabled and re-enabled the plug-in. I can't find anything in the documentation about this. Am I missing something? TIA!