diff --git a/src/content/_index.html b/src/content/_index.html index 532db27..02e74a4 100644 --- a/src/content/_index.html +++ b/src/content/_index.html @@ -7,15 +7,13 @@ description: "cspresso crawls a site with headless Chromium (Playwright) and emi
-
Brew a Content Security Policy
-

Turn real page loads into a CSP you can ship.

+

Automatically generate a CSP for your site.

cspresso crawls up to N same‑origin pages with headless Chromium (Playwright), watches the assets that load, and emits a draft Content-Security-Policy header.

- Quickstart - Docs + Docs Evaluate PyPI
@@ -32,92 +30,16 @@ description: "cspresso crawls a site with headless Chromium (Playwright) and emi 
pipx install cspresso
-cspresso https://example.com --max-pages 10
+cspresso https://mig5.net --max-pages 10
 
-# visited: https://example.com/
+# visited: https://mig5.net/
 Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; ...;
-
- Remember: it’s only a starting point: crawls may not hit every flow, and inline hashing/nonces require care. -
-
-
-
-
-

Quickstart

-
-
-
-
-
- - 
-                  
-cspresso https://mig5.net \
-  --ignore-non-html \
-  --max-pages 10
-                  
-
-
-
- -
-
-
What you’ll get
-
- A header line you can paste into your vhost, or parseable info with --json -
-
-
- Tip: if an existing CSP might block loads during analysis, add --bypass-csp. -
-
-
- -
-
- - 
# Evaluate a candidate CSP (Report-Only) and fail CI on violations
-cspresso https://mig5.net \
-  --bypass-csp \
-  --evaluate "default-src 'self'; img-src 'none';" \
-  --json
-
-{
-  [...]
-  "violations": [
-    {
-      "console": true,
-      "disposition": "report",
-      "documentURI": "https://mig5.net/",
-      "text": "Loading the image 'https://mig5.net/logo.svg' violates the following Content Security Policy directive: \"img-src 'none'\". The policy is report-only, so the violation has been logged but no further action has been taken.",
-      "type": "info"
-    },
-    {
-      "console": true,
-      "disposition": "report",
-      "documentURI": "https://mig5.net/static/mig5.asc",
-      "text": "Applying inline style violates the following Content Security Policy directive 'default-src 'self''. Either the 'unsafe-inline' keyword, a hash ('sha256-4Su6mBWzEIFnH4pAGMOuaeBrstwJN4Z3pq/s1Kn4/KQ='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback. The policy is report-only, so the violation has been logged but no further action has been taken.",
-      "type": "info"
-    }
-  ]
-}
-
-# exit code: 1 if violations detected
-
-
- -
-
-
-
-
-
@@ -126,6 +48,14 @@ cspresso https://mig5.net \

cspresso lets the browser do the hard part: execute the page, watch what it loads, and distill origins into directives.

+
+

+ It uses Playwright (a tool designed to run a browser in 'headless' mode, originally to help automate performing frontend testing of websites) to visit the website in the background and learn what directives of a Content-Security Policy would be needed in order to set such a header and still have the website function properly. +

+
+

+ It can also evaluate a provided CSP against a site and see if normal use of the site would trigger violations of the policy, before you ship it. +

diff --git a/src/layouts/partials/footer.html b/src/layouts/partials/footer.html index 1922cdb..4e56048 100644 --- a/src/layouts/partials/footer.html +++ b/src/layouts/partials/footer.html @@ -4,11 +4,7 @@
cspresso -
cspresso (a mig5 project)
-
-
- Crawl a site with headless Chromium, observe what loads, and emit a draft Content-Security-Policy. - Review and tighten before enforcing. +
(a mig5 project)
diff --git a/src/layouts/partials/nav.html b/src/layouts/partials/nav.html index 634a366..146d20c 100644 --- a/src/layouts/partials/nav.html +++ b/src/layouts/partials/nav.html @@ -3,7 +3,6 @@
cspresso - cspresso