Theme: Web site security policy Exercises: Write content-security-policy header: 1) to disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https Answer: 2) with a tag to disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https Answer: 3) to disable unsafe inline/eval, only load resources from same origin except also allow images from img.com, and disable the execution of plugins Answer: 4) to disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google, and images from same origin and img.com Answer 5) to disable the use of unsafe inline/eval, allow everything else except plugin execution Answer 6) for pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins Answer: 7) not to implement the above policy yet; instead just report violations that would have occurred Answer: 8) to disable the loading of any resources and disable framing, recommended for APIs to use Answer: