如何在Firefox和其他浏览器中使用frame-src和child-src? [英] How to use frame-src and child-src in Firefox and other browsers?
问题描述
内容安全策略指令的MDN页面指出了frame-src已弃用,应使用child-src。但是,当我尝试使用child-src时,Firefox 37给出了以下错误消息:
内容安全策略:无法处理未知指令'child-src'< unknown>
这种明显缺乏支持的情况没有记录(据我所知)是令人沮丧的。是否有任何地方的浏览器支持记录?
目前我使用的是除了child-src之外的frame-src。不过,我现在想知道两者之间是否有潜在的冲突。据推测frame-src将被支持child-src的浏览器忽略?是保证吗?
b $ b
停止使用 child-src
并再次使用 frame-src
。
为了创造更多的混淆,CSP Level 3不赞成 frame-src
,并且实际上将其重新指定为首选方式为了达成这个。虽然仍然支持
child-src
frame-src
再次受到欢迎。
旧帖子
frame-src不推荐使用
,但是最近在CSP Level 2中才做到这一点,并不是所有浏览器都符合该规范的最新版本。
目前最佳的浏览器兼容性方法是包含 child-src
和 frame-src
具有相同的值。仅支持原始CSP规范的浏览器将使用 frame-src
,而较新的将使用 child-src
p>
开发者控制台警告是没有结果的,仅仅是信息性的。我建议你暂时忽略它,因为从现在起一年你可能会很好地看到一个说 frame-src 已被弃用的。
此时,我确保在需要时使用它们,并打算在2017年1月停止提供 frame-src
。
CSP 2级支持:
$ b
The MDN page on Content Security Policy directives states the frame-src is deprecated and child-src should be used. However, Firefox 37 gives the following error message when I attempt to use child-src
Content Security Policy: Couldn't process unknown directive 'child-src' <unknown>
This apparent lack of support isn't documented (as far as I could tell) which is frustrating. Is there any place browser support is documented?
Currently I'm using frame-src in addition to child-src, which appears to work. However I'm now wondering if there is any potential for conflict between the two. Presumably frame-src will be ignored by browsers that support child-src? Is that guaranteed?
Update: Jan 2017:
Stop using child-src
and begin using frame-src
again.
In an effort to create even more confusion, CSP Level 3 has undeprecated frame-src
and actually re-appointed it as the preferred way to achieve this. While child-src
is still supported frame-src
is once again preferred.
Old post
frame-src
is deprecated, but it was only recently made so in CSP Level 2 and not all browsers are up to the latest version of the spec.
The best approach at the moment for maximum browser compatibility is to include both child-src
and frame-src
with identical values. Browsers that only support the original CSP specification will use frame-src
while newer ones will use child-src
.
That developer console warning is of no consequence and merely informational. I would suggest you ignore it for now, because a year from now you may very well see one saying that frame-src
is deprecated.
At this time, I ensure both are used when this is needed and intend to stop providing frame-src
in January of 2017.
CSP Level 2 support:
这篇关于如何在Firefox和其他浏览器中使用frame-src和child-src?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!