X-Webkit-CSP deprecated about helmet

[evilpacket]

I knew I would have to do some kajiggering with the FF changes. I'll take a look.Thanks!

[remoe]

I have the following on FF21.0:

The X-Content-Security-Policy and X-Content-Security-Report-Only headers will be deprecated in the future. Please use the Content-Security-Policy and Content-Security-Report-Only headers with CSP spec compliant syntax instead.

[evilpacket]

I plan on setting both for backward comparability for a bit. Any thoughts on that?

Adam Baldwin
CSO | &yet

On Jun 22, 2013, at 5:23 AM, Remo E [email protected] wrote:

I have the following on FF21.0

The X-Content-Security-Policy and X-Content-Security-Report-Only headers will be deprecated in the future. Please use the Content-Security-Policy and Content-Security-Report-Only headers with CSP spec compliant syntax instead.

—
Reply to this email directly or view it on GitHub.

[weisjohn]

Seeing this on Chrome 28. I'm okay with backwards compatibility...

[evilpacket]

I don't really want to add browser sniffing to set headers differently,
but it might have to be the case in the end. CSP is such a mess right
now....

John Weis wrote:

Seeing this on Chrome 28. I'm okay with backwards compatibility...

—
Reply to this email directly or view it on GitHub
#7 (comment).

[Nilos]

also csp breaks safari for me when using the x-webkit-csp header

[evilpacket]

bah, I really wish browsers had their crap together and all used the
same header / standard....

I really didn't want to have to add browser sniffing but it looks like I
might have to.

Nilos wrote:

also csp breaks safari for me when using the x-webkit-csp header

[mattjay]

I had this code floating around for browser sniffing. Might help. Requires ua-parser module.

// content_security_policy.js
var browser = require('ua-parser'),
    firefoxHeader = 'X-Content-Security-Policy',
    webkitHeader = 'X-WebKit-CSP',
    standardHeader = "Content-Security-Policy";

// UA Test Cases

var uaFF = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0';
console.log(browser.parseUA(uaFF).toString());
var uaIE = 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)';
console.log(browser.parseUA(uaIE).toString());


if (browser.parseUA(uaIE).toString().match(/Firefox/)) {
    console.log('here');
    headerType = firefoxHeader;
}
else if (browser.parseUA(uaIE).toString().match(/IE/)) {
    console.log('here IE');
    headerType = standardHeader;
}
else {
    console.log('here Webkit');
    headerType = webkitHeader;
}

[renehamburger]

I've just made a pull request to include user agent testing for csp.js.

[Nilos]

You can link to a pr by just putting hashtag and the Number here like this: #16

[angleman]

Like the idea of moving towards the CSP 1 headers instead of the X-* variants. What about handling this via project semver? Keep 0.0.x for X-* headers and move to 0.1.x for the non X-* headers. Thoughts?

[evilpacket]

Yeah I'm kind of gridlocked as to what to do. I really don't like / want
to support legacy prefixed headers but I don't want to leave those
browsers out in the cold as to CSP support.

Looking for any other ideas before I just go ahead and merge in the
browser sniffing code, etc....

angleman wrote:

Like the idea of moving towards the CSP 1 headers instead of the X-*
variants. What about handling this via project semver? Keep 0.0.x for
X-* headers and move to 0.1.x for the non X-* headers. Thoughts?

—
Reply to this email directly or view it on GitHub
#7 (comment).

[renehamburger]

It would be so much easier just having to support the CSP 1 specs, but several current browsers are still relying on the prefixed headers (see http://caniuse.com/contentsecuritypolicy). Even if they all moved to CSP 1 for the next version many of those browsers will still be around for quite a while. And anyone implementing CSP for their site would want to cover as many of their users' browsers as possible.

[angleman]

What about a legacy flag, like helmet.csp({legacy:true}))? If set, then send the X-* variants also. Then the legacy flag could be depreciated say when CSP 1.1 is finalized and sometime after that when the quantity of legacy browsers in the wild is small, then remove the legacy flag entirely.

[EvanHahn]

Addressed by c0f695d.