Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #39033
| Newsgroups | comp.lang.javascript |
|---|---|
| Date | 2020-10-22 11:46 -0700 |
| References | <rmdmmp$2c5l$3@gallifrey.nk.ca> <rmmnrh$vme$1@gallifrey.nk.ca> <457449fa-50ef-4d27-994c-14751ed6ebf9n@googlegroups.com> <rmpert$1qts$3@gallifrey.nk.ca> <rms26o$1fch$1@gallifrey.nk.ca> |
| Message-ID | <7eb85e54-65c1-4541-a04f-a186e67f8a3dn@googlegroups.com> (permalink) |
| Subject | Re: Chrome and passing on cross-origin |
| From | "Michael Haufe (TNO)" <tno@thenewobjective.com> |
On Thursday, October 22, 2020 at 8:41:54 AM UTC-5, The Doctor wrote:
> In article <rmpert$1qts$3...@gallifrey.nk.ca>,
> The Doctor <doc...@doctor.nl2k.ab.ca> wrote:
> >In article <457449fa-50ef-4d27...@googlegroups.com>,
> >Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
> >>On Tuesday, October 20, 2020 at 8:14:35 AM UTC-5, The Doctor wrote:
> >>
> >>> Indicate whether to send a cookie in a cross-site request by
> >>specifying its SameSite attribute
> >>>
> >>> How do Do that on a WEb PAge?
> >>
> >><https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite>
> >>
> >
> >All right, trying to get this.
> >--
> Still trying to see how to implement this in an .html page.
This one has to be done on the server.
If you're using Apache:
<https://stackoverflow.com/a/59128049/153209>
If you're using IIS:
<https://docs.microsoft.com/en-us/aspnet/samesite/system-web-samesite>
For Node.js (Express)
```
res.cookie(‘sessionID’, user.sessionID, { secure: true, sameSite: true });
```
> Meawhile when I turn on the CSP the calculator is surpressed
>
> and from the chrome debug we get
>
> Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https://www.nk.ca https://secure.nl2k.ab.ca https://cdn.jsdelivr.net/ https://code.jquery.com https://ajax.googleapis.com https://cdnjs.cloudflare.com/ https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net https://www3.moneris.com/ ". Either the 'unsafe-inline' keyword, a hash ('sha256-PIiPJXfBkkwdkWWFA7MWowVWRKJQkLqnr9eToZB+1Kk='), or a nonce ('nonce-...') is required to enable inline execution.
The key part here is: "Refused to execute inline script"
Your current policy demands that all JavaScript be included via a <script> tag. So move the inline scripts to external files
Otherwise you need to add 'unsafe-inline' to the script-src.
Note that if you use 'unsafe-inline' you're observatory score [1] will be lower.
[1] <https://observatory.mozilla.org/>
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 02:59 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-16 21:45 -0700
Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-17 11:00 +0200
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 13:24 +0000
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 22:27 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-17 17:30 -0700
Re: Chrome and passing on cross-origin "J.O. Aho" <user@example.net> - 2020-10-18 16:14 +0200
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 10:17 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-18 22:15 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 15:31 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 00:54 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 18:51 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 02:43 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 19:48 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 21:58 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-19 21:11 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 05:04 +0000
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 13:14 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-21 13:59 +0000
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 13:41 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-22 11:46 -0700
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 22:36 +0000
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 02:42 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 14:47 -0700
Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:05 +0200
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 15:24 -0700
Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:53 +0200
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 23:42 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 21:19 -0700
Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 15:33 +0100
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-25 18:49 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-25 12:04 -0700
Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-26 00:31 +0100
Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-26 00:44 +0000
Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700
csiph-web