Csp on Commentary of Takao

為 Hugo 部落格設計現代內容安全策略

Fri, 05 Jun 2026 00:00:00 +0900

為什麼 CSP 對於靜態網站很重要

使用 Hugo 建立的靜態網站本質上比動態應用程式更安全，但它們仍然執行用於分析、廣告和嵌入的第三方腳本。 內容安全策略 (CSP) 透過控制可以載入的資源來保護您的訪客免受 XSS、資料注入和惡意腳本執行的侵害。

Testing CSP 規矩 Safely with Content-Security-Policy-Report-Only

Fri, 15 May 2026 00:00:00 +0900

Deploying a Content Security Policy is one of the strongest defenses against XSS attacks. But a single misconfigured directive can silently break inline scripts, block CDN resources, or disable analytics. If you apply CSP directly via the Content-Security-Policy header and a critical script gets blocked, your production site breaks—often without an obvious error console notification.

This is where Report-Only mode saves the day.

Why and 如何 Adopt 'strict-dynamic' in CSP

Sun, 15 Jun 2025 00:00:00 +0900

Introduction

Implementing a Content Security Policy (CSP) is a highly effective way to mitigate Cross-Site Scripting (XSS) risks. However, configuring and maintaining the policy can become a major headache.