Should I allow http script sources in my CSP, or enforce https only?

Question

I'm currently trying to implement a third-party widget into my website. That widget attempts to load some scripts over http, which is currently disallowed by my content security policy.

I'm concerned that setting the CSP to allow a script loaded over http would enable a man in the middle attack. The offending widget is on the login page, among other places, so an injected malicious script could easily steal someone's password.

Practically speaking, how concerned should I be about this? Should I enforce https-only script-src in my CSP?

Answer 1

You are completely correct that loading just one script over HTTP means walkover to a MITM. So what can you do?

If the script is served over HTTPS
As Ajedi32 suggests in comments: If the script is served over HTTPS, you can force the widget to use HTTPS by using the CSP upgrade-insecure-requests directive.

If you have control over the script tag
If the script isn't served over HTTPS at all, things will be a bit more complicated. You don't have to allow all scripts to be loaded over HTTPS, you can just allow that one. Still, for a MITM that would be enough.

If you have control over the script tag where the script is included, you can use subresource integrity to stop a MITM. You provide a hash of the script in the integrity attribute of the script tag. The browser verifies the hash, thereby stopping any attempts by a MITM to modify the script. It will also give you a headache if the maintainers of the script changes the content without notifying you first...

Else
You are out of luck. Contact whoever constructed the widget and tell them to use HTTPS. Or just dump the widget.