After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application.

Our current header is set as mentioned below-

Server: Apache X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
Content-Length: 151 Last-Modified: Wed, 04 Apr 2018 08:18:16 GMT
X-Powered-By: Servlet/2.5 JSP/2.1 Content-Security-Policy: default-src
'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com www.google.com
*.google-analytics.com ; img-src 'self' data: ; Strict-Transport-Security: max-age=31536000; includeSubDomains;
preload X-XSS-Protection: 1; mode=block Content-Type: text/html

Can you please help to understand how the issue can be resolved? We tried nonce approach also but couldn't get succeed we are left with below issue

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-1vb337j47ngp6'". Either the 'unsafe-inline' keyword, a hash ('sha256-mf8m/qIWtvEARCPQ2lxzyNeJ+xiFw84zHgmCq5rxqbo='), or a nonce ('nonce-...') is required to enable inline execution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.