Not at all.
Let's say I build my website
supersite.com with a lot of JS, so I want it to be able to run scripts, but I also want to put some adds, but I don't want it to be dynamic and thus doesn't execute
The problem is that usually, my add provider do include script. To avoid this, I explically tell him that I do not want script, I'll then set the following
<iframe src="http://addprovider.com/?site=mywebsite" csp="script-src 'none'"></iframe>
While sending the
GET request to
addprovider.com, the following header will be set :
Embedding-CSP: script-src 'none'
addprovider.com knows that if it puts
supersite.com will refused to execute the script and thus decide to put some fancy images instead. While sending back the answer,
addprovider.com shows that it accepts the given policy by setting the following header:
Content-Security-Policy: script-src 'none'
addprovider.com try to cheat and send back that its answer is csp complient but doesn't,
supersite.com the response will be blocked.
addprovider doesn't return csp or return a csp that doesn't match or enforce the given
csp, the response will be blocked too.
How is it usefull ? This are the 2 alternatives atm :
supersite.com, with header or meta tag :
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">. Howewer, this
CSP will not apply to the embedded
sandbox attributes. Howewer, this it too broad. You can only block all
script or none. You can't specify different locations while you can do with