I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP).

This document defines a mechanism by which a web page can embed a nested browsing context if and only if it agrees to enforce a particular set of restrictions upon itself. Source: Content Security Policy: Embedded Enforcement

Unless I understood it completely wrong, does this Embedding-CSP not ruin the fundamentals of CSP completely?

In a case wherin you can inject HTML (with an iframe) or JS (XSS) you'd be able to set such "Embedded CSP" attribute? That overwrites the CSP from the original HTTP response? That seems undesirable.

1 Answer 1


Not at all.

Let's say I build my website supersite.com with a lot of JS, so I want it to be able to run scripts, but I also want to put some adds, but I don't want it to be dynamic and thus doesn't execute script.

The problem is that usually, my add provider do include script. To avoid this, I explically tell him that I do not want script, I'll then set the following iframe:

<iframe src="http://addprovider.com/?site=mywebsite" csp="script-src 'none'"></iframe>

While sending the GET request to addprovider.com, the following header will be set :

Embedding-CSP: script-src 'none'

From there, addprovider.com knows that if it puts script, supersite.com will refused to execute the script and thus decide to put some fancy images instead. While sending back the answer, addprovider.com shows that it accepts the given policy by setting the following header:

Content-Security-Policy: script-src 'none'

If addprovider.com try to cheat and send back that its answer is csp complient but doesn't, supersite.com the response will be blocked. If addprovider doesn't return csp or return a csp that doesn't match or enforce the given csp, the response will be blocked too.

How is it usefull ? This are the 2 alternatives atm :

  • Set a CSP on supersite.com, with header or meta tag : <meta http-equiv="Content-Security-Policy" content="script-src 'self'">. Howewer, this CSP will not apply to the embedded addprovider.com !

  • Use sandbox attributes. Howewer, this it too broad. You can only block all script or none. You can't specify different locations while you can do with CSP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .