CSP - Whitelist Content Location: does it work for a site that has tracking...

mike_plumbs

CSP uses a whitelist of domains that can host content. Can this work with a site that uses affiliate marketing? Typically on an "order completed" page there is an iframe that hosts a script that is in controll of an affiliate partner. It would be ok to whitelist the domain of the affiliate-script, but I am in no controll of what the script does: I am pretty shure it will load other content that is not whitelistet. Does anybody have good or bad...

Originally asked by Mathias F on Stack Exchange (stackoverflow) (CC BY-SA 3.0).

uphilltech

Great question — answering as the UphillTech team:

Regarding to this article you have to whitelist every single source you load scripts from. Every source for every kind of data. http://www.domblogger.net/Security/CSP The affiliate script stuff (i've seen so far) never calls scripts from 2nd+ level locations. The scripts do requests to process data on server side and there are redirects of those request to get cookies to your browser for example. Technically you could run affiliate stuff with unknown sources with 'unsafe-inline'. But thats not recommended.

Full answer by user887983: https://stackoverflow.stackexchange.com/a/14871643 (CC BY-SA 3.0).

Need it done for your business? UphillTech.