{"id":9079,"date":"2026-08-25T13:42:55","date_gmt":"2026-08-25T10:42:55","guid":{"rendered":"https:\/\/www.domainhizmetleri.com\/blog\/?p=9079"},"modified":"2026-08-25T13:42:56","modified_gmt":"2026-08-25T10:42:56","slug":"content-security-policy-nedir","status":"publish","type":"post","link":"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/","title":{"rendered":"Content Security Policy Nedir? CSP Ba\u015fl\u0131\u011f\u0131 Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_87 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Yaz\u0131 \u0130\u00e7eri\u011fi<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"\u0130\u00e7indekiler Tablosunu A\u00e7\/Kapat\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #0a0a0a;color:#0a0a0a\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #0a0a0a;color:#0a0a0a\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#Content_Security_Policy_Nedir\" >Content Security Policy Nedir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#CSP_Basligi_Nasil_Calisir\" >CSP Ba\u015fl\u0131\u011f\u0131 Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#CSP_Yonergeleri_Nelerdir\" >CSP Y\u00f6nergeleri Nelerdir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#CSP_Basligi_Nasil_Yapilandirilir\" >CSP Ba\u015fl\u0131\u011f\u0131 Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#Inline_JavaScript_ve_CSS_Nasil_Yonetilir\" >Inline JavaScript ve CSS Nas\u0131l Y\u00f6netilir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#CSP_Report-Only_Modu_Nedir\" >CSP Report-Only Modu Nedir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#CSP_Yapilandirilirken_Nelere_Dikkat_Edilmelidir\" >CSP Yap\u0131land\u0131r\u0131l\u0131rken Nelere Dikkat Edilmelidir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.domainhizmetleri.com\/blog\/content-security-policy-nedir\/#Sonuc\" >Sonu\u00e7<\/a><\/li><\/ul><\/nav><\/div>\n\n<p class=\"wp-block-paragraph\">Web uygulamalar\u0131nda kullan\u0131lan JavaScript, CSS, yaz\u0131 tipi, g\u00f6rsel ve medya dosyalar\u0131 farkl\u0131 kaynaklardan y\u00fcklenebilir. Bu esneklik geli\u015ftirme s\u00fcrecini kolayla\u015ft\u0131rsa da k\u00f6t\u00fc ama\u00e7l\u0131 kodlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 veya g\u00fcvenilmeyen kaynaklardan i\u00e7erik \u00e7ekilmesi gibi riskler olu\u015fturabilir. Content Security Policy, taray\u0131c\u0131n\u0131n hangi kaynaklara g\u00fcvenece\u011fini belirleyerek web uygulamalar\u0131na ek bir g\u00fcvenlik katman\u0131 kazand\u0131r\u0131r. Bu rehberde Content Security Policy nedir, CSP ba\u015fl\u0131\u011f\u0131 nas\u0131l \u00e7al\u0131\u015f\u0131r ve g\u00fcvenli bi\u00e7imde nas\u0131l yap\u0131land\u0131r\u0131l\u0131r sorular\u0131n\u0131 ele al\u0131yoruz.<\/p>\n\n\n<figure class=\"wp-block-post-featured-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"502\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T214042.702.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"\" style=\"object-fit:cover;\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T214042.702.png 1200w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T214042.702-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T214042.702-1024x428.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T214042.702-990x414.png 990w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Content_Security_Policy_Nedir\"><\/span>Content Security Policy Nedir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Content Security Policy, T\u00fcrk\u00e7ede \u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131 olarak ifade edilen bir taray\u0131c\u0131 g\u00fcvenlik mekanizmas\u0131d\u0131r. Web sunucusu taraf\u0131ndan g\u00f6nderilen CSP ba\u015fl\u0131\u011f\u0131, sayfa i\u00e7erisinde hangi kaynaklardan i\u00e7erik y\u00fcklenebilece\u011fini belirler.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bu politika sayesinde JavaScript dosyalar\u0131, stil dosyalar\u0131, g\u00f6rseller, yaz\u0131 tipleri, medya i\u00e7erikleri ve iframe ba\u011flant\u0131lar\u0131 i\u00e7in ayr\u0131 kurallar olu\u015fturulabilir. Taray\u0131c\u0131, belirlenen politikan\u0131n d\u0131\u015f\u0131nda kalan bir kaynak tespit etti\u011finde ilgili i\u00e7eri\u011fin y\u00fcklenmesini veya \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSP \u00f6zellikle Cross-Site Scripting olarak bilinen XSS sald\u0131r\u0131lar\u0131n\u0131n etkisini azaltmak amac\u0131yla kullan\u0131l\u0131r. Ancak tek ba\u015f\u0131na b\u00fct\u00fcn g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 ortadan kald\u0131rmaz. G\u00fcvenli kodlama, g\u00fcncel yaz\u0131l\u0131m kullan\u0131m\u0131 ve d\u00fczenli g\u00fcvenlik kontrolleriyle birlikte uygulanmas\u0131 gerekir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-1024x429.png\" alt=\"\" class=\"wp-image-9082\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CSP_Basligi_Nasil_Calisir\"><\/span>CSP Ba\u015fl\u0131\u011f\u0131 Nas\u0131l \u00c7al\u0131\u015f\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kullan\u0131c\u0131 web sayfas\u0131n\u0131 ziyaret etti\u011finde sunucu, HTML i\u00e7eri\u011fiyle birlikte HTTP yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 da g\u00f6nderir. <code>Content-Security-Policy<\/code> ba\u015fl\u0131\u011f\u0131 bu yan\u0131t i\u00e7erisinde yer al\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Taray\u0131c\u0131, sayfadaki kaynaklar\u0131 y\u00fcklemeden \u00f6nce CSP kurallar\u0131n\u0131 inceler. Bir JavaScript dosyas\u0131 veya g\u00f6rsel izin verilen kaynaklar aras\u0131ndaysa y\u00fckleme i\u015flemi ger\u00e7ekle\u015ftirilir. Kaynak politika d\u0131\u015f\u0131nda kal\u0131yorsa taray\u0131c\u0131 iste\u011fi engeller ve geli\u015ftirici konsolunda bir CSP hatas\u0131 g\u00f6sterebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Temel bir CSP ba\u015fl\u0131\u011f\u0131 a\u015fa\u011f\u0131daki \u015fekilde yap\u0131land\u0131r\u0131labilir:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Content-Security-Policy: default-src 'self';<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bu kural, sayfadaki i\u00e7eriklerin yaln\u0131zca mevcut alan ad\u0131ndan y\u00fcklenmesine izin verir. Buradaki <code>'self'<\/code> ifadesi, ziyaret edilen sayfan\u0131n kendi kayna\u011f\u0131n\u0131 temsil eder.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-1024x429.png\" alt=\"\" class=\"wp-image-9083\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/yonerge.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CSP_Yonergeleri_Nelerdir\"><\/span>CSP Y\u00f6nergeleri Nelerdir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSP yap\u0131land\u0131rmas\u0131 farkl\u0131 i\u00e7erik t\u00fcrlerini y\u00f6neten direktiflerden olu\u015fur. Her direktif, taray\u0131c\u0131n\u0131n belirli bir kaynak t\u00fcr\u00fc i\u00e7in nas\u0131l davranaca\u011f\u0131n\u0131 belirler.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yayg\u0131n olarak kullan\u0131lan CSP direktifleri \u015funlard\u0131r:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>default-src<\/code>: \u00d6zel bir kural tan\u0131mlanmayan kaynaklar i\u00e7in varsay\u0131lan politikay\u0131 belirler.<\/li>\n\n\n\n<li><code>script-src<\/code>: JavaScript dosyalar\u0131n\u0131n ve kodlar\u0131n\u0131n hangi kaynaklardan \u00e7al\u0131\u015ft\u0131r\u0131labilece\u011fini y\u00f6netir.<\/li>\n\n\n\n<li><code>style-src<\/code>: CSS dosyalar\u0131 ile sayfa i\u00e7i stil kullan\u0131mlar\u0131n\u0131 s\u0131n\u0131rland\u0131r\u0131r.<\/li>\n\n\n\n<li><code>img-src<\/code>: G\u00f6rsellerin y\u00fcklenebilece\u011fi kaynaklar\u0131 tan\u0131mlar.<\/li>\n\n\n\n<li><code>font-src<\/code>: Web yaz\u0131 tiplerinin al\u0131nabilece\u011fi konumlar\u0131 belirler.<\/li>\n\n\n\n<li><code>connect-src<\/code>: API, WebSocket ve benzeri ba\u011flant\u0131lar\u0131n kurulabilece\u011fi kaynaklar\u0131 y\u00f6netir.<\/li>\n\n\n\n<li><code>frame-src<\/code>: Sayfaya iframe arac\u0131l\u0131\u011f\u0131yla eklenebilecek i\u00e7erikleri s\u0131n\u0131rland\u0131r\u0131r.<\/li>\n\n\n\n<li><code>object-src<\/code>: Eklenti tabanl\u0131 nesnelerin y\u00fcklenmesini kontrol eder.<\/li>\n\n\n\n<li><code>form-action<\/code>: Form verilerinin g\u00f6nderilebilece\u011fi adresleri belirler.<\/li>\n\n\n\n<li><code>frame-ancestors<\/code>: Sayfan\u0131n ba\u015fka sitelerde iframe i\u00e7erisinde a\u00e7\u0131l\u0131p a\u00e7\u0131lamayaca\u011f\u0131n\u0131 d\u00fczenler.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Her direktif noktal\u0131 virg\u00fclle ayr\u0131l\u0131r. B\u00f6ylece tek bir HTTP ba\u015fl\u0131\u011f\u0131 i\u00e7erisinde birden fazla g\u00fcvenlik kural\u0131 tan\u0131mlanabilir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-1024x429.png\" alt=\"\" class=\"wp-image-9084\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-1536x644.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-990x415.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2-1320x553.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/csp-basligi-2.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CSP_Basligi_Nasil_Yapilandirilir\"><\/span>CSP Ba\u015fl\u0131\u011f\u0131 Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSP politikas\u0131 haz\u0131rlan\u0131rken \u00f6nce web sayfas\u0131n\u0131n kulland\u0131\u011f\u0131 kaynaklar belirlenmelidir. JavaScript, CSS, g\u00f6rsel, yaz\u0131 tipi ve API ba\u011flant\u0131lar\u0131 ayr\u0131 ayr\u0131 incelenmelidir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sadece ayn\u0131 alan ad\u0131ndaki kaynaklara izin veren \u00f6rnek bir yap\u0131land\u0131rma \u015f\u00f6yledir:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self'; form-action 'self';\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bu yap\u0131land\u0131rmada kaynaklar\u0131n genel olarak yaln\u0131zca mevcut alan ad\u0131ndan y\u00fcklenmesine izin verilir. <code>data:<\/code> ifadesi veri URI bi\u00e7imindeki g\u00f6rselleri destekler. <code>object-src 'none'<\/code> eklenti tabanl\u0131 nesneleri kapat\u0131rken <code>form-action 'self'<\/code> form g\u00f6nderimlerini ayn\u0131 kayna\u011fa s\u0131n\u0131rland\u0131r\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSP ba\u015fl\u0131\u011f\u0131 Apache, Nginx veya uygulama katman\u0131 \u00fczerinden eklenebilir. Kullan\u0131lan y\u00f6nteme g\u00f6re yap\u0131land\u0131rma dosyas\u0131n\u0131n bi\u00e7imi de\u011fi\u015fse de taray\u0131c\u0131ya g\u00f6nderilen ba\u015fl\u0131\u011f\u0131n i\u00e7eri\u011fi ayn\u0131 mant\u0131kla \u00e7al\u0131\u015f\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-1024x429.png\" alt=\"\" class=\"wp-image-9085\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/java.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Inline_JavaScript_ve_CSS_Nasil_Yonetilir\"><\/span>Inline JavaScript ve CSS Nas\u0131l Y\u00f6netilir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sayfa i\u00e7erisine do\u011frudan yaz\u0131lan JavaScript ve CSS kodlar\u0131 CSP yap\u0131land\u0131rmalar\u0131nda sorun olu\u015fturabilir. G\u00fcvenli\u011fi art\u0131rmak i\u00e7in bu kodlar\u0131n ayr\u0131 dosyalara ta\u015f\u0131nmas\u0131 ve yaln\u0131zca g\u00fcvenilir kaynaklardan y\u00fcklenmesi \u00f6nerilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Baz\u0131 projelerde sayfa i\u00e7i kodlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 zorunlu olabilir. Bu durumda <code>nonce<\/code> veya hash tabanl\u0131 yetkilendirme y\u00f6ntemleri kullan\u0131labilir. Nonce, her HTTP yan\u0131t\u0131nda yeniden olu\u015fturulan tahmin edilmesi zor bir de\u011ferdir. Yaln\u0131zca ayn\u0131 nonce de\u011ferini ta\u015f\u0131yan kod bloklar\u0131n\u0131n \u00e7al\u0131\u015fmas\u0131na izin verilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>'unsafe-inline'<\/code> ifadesi sayfa i\u00e7i kodlar\u0131n genel olarak \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 sa\u011flar. Ancak CSP korumas\u0131n\u0131 zay\u0131flatabilece\u011fi i\u00e7in m\u00fcmk\u00fcn oldu\u011funca kullan\u0131lmamal\u0131d\u0131r. Benzer \u015fekilde JavaScript de\u011ferlendirme fonksiyonlar\u0131na izin veren <code>'unsafe-eval'<\/code> se\u00e7ene\u011fi de gerekli olmad\u0131\u011f\u0131 s\u00fcrece etkinle\u015ftirilmemelidir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-1024x429.png\" alt=\"\" class=\"wp-image-9086\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-1536x644.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-990x415.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode-1320x553.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/only-mode.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CSP_Report-Only_Modu_Nedir\"><\/span>CSP Report-Only Modu Nedir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yeni bir CSP politikas\u0131 do\u011frudan aktif edildi\u011finde web sayfas\u0131ndaki gerekli dosyalar yanl\u0131\u015fl\u0131kla engellenebilir. Bu nedenle yap\u0131land\u0131rman\u0131n \u00f6nce raporlama modunda test edilmesi faydal\u0131d\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Raporlama modu a\u015fa\u011f\u0131daki ba\u015fl\u0131kla uygulan\u0131r:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Content-Security-Policy-Report-Only: default-src 'self';\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bu ba\u015fl\u0131k, ihlalleri taray\u0131c\u0131 konsolunda g\u00f6sterir ancak kaynaklar\u0131 hemen engellemez. Gerekli kontroller tamamland\u0131ktan ve politika hatalar\u0131 giderildikten sonra standart <code>Content-Security-Policy<\/code> ba\u015fl\u0131\u011f\u0131na ge\u00e7ilebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Raporlama modu kal\u0131c\u0131 bir koruma sa\u011flamaz. Yaln\u0131zca olu\u015fturulan kurallar\u0131n web sayfas\u0131 \u00fczerindeki etkisini g\u00f6rmek ve eksik kaynaklar\u0131 belirlemek amac\u0131yla kullan\u0131lmal\u0131d\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-1024x429.png\" alt=\"\" class=\"wp-image-9088\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/dikkat-9.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CSP_Yapilandirilirken_Nelere_Dikkat_Edilmelidir\"><\/span>CSP Yap\u0131land\u0131r\u0131l\u0131rken Nelere Dikkat Edilmelidir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Her web uygulamas\u0131n\u0131n kulland\u0131\u011f\u0131 kaynaklar farkl\u0131 oldu\u011fu i\u00e7in tek bir CSP politikas\u0131 b\u00fct\u00fcn projelere do\u011frudan uygulanamaz. \u00c7ok geni\u015f izinler vermek politikan\u0131n etkisini azalt\u0131rken a\u015f\u0131r\u0131 k\u0131s\u0131tlay\u0131c\u0131 kurallar sayfan\u0131n baz\u0131 b\u00f6l\u00fcmlerinin \u00e7al\u0131\u015fmamas\u0131na neden olabilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yap\u0131land\u0131rma s\u0131ras\u0131nda taray\u0131c\u0131 geli\u015ftirici konsolu kontrol edilmeli, engellenen kaynaklar incelenmeli ve yaln\u0131zca ger\u00e7ekten ihtiya\u00e7 duyulan izinler eklenmelidir. Yeni eklenti, tema veya entegrasyon kuruldu\u011funda CSP politikas\u0131n\u0131n tekrar g\u00f6zden ge\u00e7irilmesi gerekir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSP, uygulamadaki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 d\u00fczeltmek yerine sald\u0131r\u0131lar\u0131n etkisini s\u0131n\u0131rland\u0131rmaya yard\u0131mc\u0131 olur. Bu nedenle kullan\u0131c\u0131 girdileri do\u011frulanmal\u0131, \u00e7\u0131kt\u0131lar g\u00fcvenli bi\u00e7imde i\u015flenmeli ve kullan\u0131lan yaz\u0131l\u0131mlar g\u00fcncel tutulmal\u0131d\u0131r.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Sonuc\"><\/span>Sonu\u00e7<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Content Security Policy, web sayfas\u0131nda \u00e7al\u0131\u015ft\u0131r\u0131labilecek kodlar\u0131 ve y\u00fcklenebilecek kaynaklar\u0131 s\u0131n\u0131rland\u0131ran \u00f6nemli bir g\u00fcvenlik katman\u0131d\u0131r. Do\u011fru yap\u0131land\u0131r\u0131lan CSP ba\u015fl\u0131\u011f\u0131; k\u00f6t\u00fc ama\u00e7l\u0131 kodlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 zorla\u015ft\u0131rabilir, g\u00fcvenilmeyen i\u00e7erikleri engelleyebilir ve XSS sald\u0131r\u0131lar\u0131n\u0131n etkisini azaltabilir. Politikan\u0131n \u00f6nce raporlama modunda test edilmesi ve yaln\u0131zca ihtiya\u00e7 duyulan kaynaklara izin verilmesi sa\u011fl\u0131kl\u0131 bir yap\u0131land\u0131rma i\u00e7in \u00f6nemlidir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.domainhizmetleri.com\/limitsiz-hosting\/\" target=\"_blank\" rel=\" noreferrer noopener\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"290\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1024x290.png\" alt=\"\" class=\"wp-image-8461\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1024x290.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-300x85.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1536x435.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-scaled.png 2048w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-990x280.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1320x374.png 1320w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Domainhizmetleri olarak h\u0131zl\u0131, g\u00fcvenli ve stabil hosting altyap\u0131m\u0131zla web projelerinize uygun \u00e7\u00f6z\u00fcmler sunuyoruz. G\u00fcvenlik katmanlar\u0131yla desteklenen hosting hizmetlerimizden yararlanarak web sitenizin daha g\u00fcvenli bir ortamda yay\u0131nlanmas\u0131n\u0131 sa\u011flayabilirsiniz.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Web uygulamalar\u0131nda kullan\u0131lan JavaScript, CSS, yaz\u0131 tipi, g\u00f6rsel ve medya dosyalar\u0131 farkl\u0131 kaynaklardan y\u00fcklenebilir. Bu esneklik geli\u015ftirme s\u00fcrecini kolayla\u015ft\u0131rsa da k\u00f6t\u00fc ama\u00e7l\u0131 kodlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 veya g\u00fcvenilmeyen kaynaklardan i\u00e7erik \u00e7ekilmesi gibi riskler olu\u015fturabilir. Content Security Policy, taray\u0131c\u0131n\u0131n hangi kaynaklara g\u00fcvenece\u011fini belirleyerek web uygulamalar\u0131na ek bir g\u00fcvenlik katman\u0131 kazand\u0131r\u0131r. Bu rehberde Content Security Policy nedir, CSP ba\u015fl\u0131\u011f\u0131 [&hellip;]<\/p>\n","protected":false},"author":17,"featured_media":9081,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,145],"tags":[315],"class_list":["post-9079","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bilim-ve-teknoloji-dunyasi","category-nedir-nasil","tag-csp"],"views":0,"_links":{"self":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/comments?post=9079"}],"version-history":[{"count":1,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9079\/revisions"}],"predecessor-version":[{"id":9089,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9079\/revisions\/9089"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/media\/9081"}],"wp:attachment":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/media?parent=9079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/categories?post=9079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/tags?post=9079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}