I am in the process of implementing a CSP header for a webapp, with the goal of reducing possible XSS attacks. See CSP for an overview of CSP. I provided the base-uri directive as 'self' and this works as expected with violations being reported to the report-uri. See base-uri for an explanation of the base-uri directive.
What is surprising to me is that when I use chrome (Version 56.0.2924.87 64-bit) to "View page source" there is a CSP violation report. Here is an example of the violation report:
{
"csp-report": {
"document-uri": "http://localhost:8080/frontend/Page1.action?param1=1",
"referrer": "",
"violated-directive": "base-uri",
"effective-directive": "base-uri",
"original-policy": "base-uri 'self'; report-uri /frontend/CspReport.action?",
"disposition": "report",
"blocked-uri": "http://localhost:8080/frontend/",
"status-code": 200
}
}
I simplified the policy to make sure nothing else is interfering. From what I understand the "blocked-uri" should match the 'self' keyword because it matches the beginning of the "document-uri".
What makes this more strange is that it only happens when viewing source on some pages (but on these pages it happens 100% of the time) and does not seem to happen on firefox at all and does not happen when simply navigating between pages.
So, the question is why is this a CSP violation when it seems to not violate the specified directive?
view-source
is a separate scheme.