Changes for version 0.03

  • Fixed the response header name: it was "content-security-protocol", which no browser reads, so the policy was never enforced. It is now "Content-Security-Policy" ("policy", not "protocol"). Reported by lmasarati as github issue #1.

Modules

Apply HTTP::CSPHeader to your psgi application.