Explore web applications through their content security policy (CSP)

1

Google

By default, Secutils.dev allows importing CSP from the Content-Security-Policy HTTP header, matching the HTTP header (enforcing) policy source in the import dialog. However, attempting to import CSP from this source results in an error. Surprisingly, google.com doesn't transmit this header. Instead, it delivers CSP via the Content-Security-Policy-Report-Only HTTP header! It actually makes sense when you think about it: as the most visited website on the planet, they wouldn't want to accidentally disrupt anything with CSP changes, especially considering the need to support all web browsers. Instead, opting for a robust monitoring solution around CSP violation reporting seems more plausible. They might even set up alerts for suspicious activities that could indicate attempts to harm users through their website. This is, of course, speculative, but it seems to align logically.

#Search Engine #Internet Search #Web Search 3693 social mentions

2

DuckDuckGo

Okay, let's explore something more exotic - duckduckgo.com. And would you look at that!

#Search Engine #Web Search #Internet Search 1669 social mentions

3

Bing

Alright, let's take a look at Google's competitor - bing.com. And here's the first surprise - Bing doesn't utilize CSP at all! Who would've thought?

#Search Engine #Internet Search #Mapping And GIS 337 social mentions