Is it safe to send Content-Security-Policy
for dynamically generated pages with text/html
and other hypertext content-types only or do I need to send this header for all files including static assets - images, JS and CSS files?
1 Answer
There are, cases where users can influence MIME type based on different factors. For example, IE can be fooled to render text/plain
as text/html
within certain circumstances. And, again there are various other MIME types which are rendered and can exfiltrate data. For example, even pdf files can execute JavaScript and so can Flash, SVG, XML or any other plug-in handled content types.
Therefore, it's best to apply CSP using configuration file on all rendered contents.
On a side note, always return correct content type with correct charset attribute along with X-Content-Type-Options: nosniff
header.
-
I have
nosniff
already applied. For user uploaded files I can apply a strict CSP policy which doesn't need to change. But the files I have in mind are static assets of the web application which are managed by developers.– AlexDMay 25, 2018 at 17:34 -
Also, I understand that CSP can limit plugins used on the page but is the CSP honored by browser plugins?– AlexDMay 25, 2018 at 17:54
-
No, plug-ins can do whatever they want. And, please remember, on same origin, any MIME type can be sniffed unless instructed not to. May 26, 2018 at 4:44
-
So, what is the point of applying CSP for a PDF if it is ignored by a plugin used to render it?– AlexDMay 26, 2018 at 16:24
-
Well, PDFs no longer require a separate plug-in. It is handled by the pdf.js library. May 26, 2018 at 18:52
text/xml
content which can be rendered as (x)HTML, but I do not see the point in configuring the server to send different security headers based on mimetype.png
should be quite safe, but I would be not that sure forsvg
for instance or folders for user uploads and similar.svg
but I'm not sure about other types.