Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-src due to a third-party component. (Both connect-src and img-src are otherwise restricted to self and some hard-coded URLs.)

So, my question is: Is allowing blob: a general security risk in the sense that an attacker can in an injected script wrap any URL with blob and thus connect to any arbitrary resource?

  • Are you sure what this 3rd party component puts in that Blob? blob: could be an attack vector if attacker manage to create a Blob of their attack script. Difference with data: or http: is that this Blob must be created on the same origin than your website, which narrows the ways of building it (you cannot load a Blob from another origin using blob:) – Xenos Jul 25 '18 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.