I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?


I wasn't able to find any official reason. But generally, injection of a base tag can be used in HTML injections.

For example, consider that an attacker can only post very limited HTML (but can use base). Depending on the point of injection, they could now hijack existing forms to send the information (eg CSRF tokens, passwords, etc) to their server.

Of course, in this case setting form-action would be better than setting base-uri, but might not be practical (eg because legitimate users need to create arbitrary forms).

Another example would be a case where developers can't or don't want to restrict where scripts are loaded from. They have an XSS filter in place which prevents script injection, but they forgot to filter base. An attacker could now perform XSS via base HTML injection. Setting a base-uri would prevent this.

The examples might seem a bit far-fetched. But I would assume that it is these sorts of corner cases that the directives are meant to protect. The base tag has little practical use (at least in production), so why not provide the option to limit it?


From the docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

How does this work with base-uri? You would define base-uri to be your website's domain (i.e. example.com), this would limit includes to only be within the base-uri's domain.

As an example someone uses an XSS to do a remote include that loads an iframe (attacker.com/iframe.html) to steal users credentials. Since that is outside of base-uri that iframe will not load.

Hope that helps.

  • 2
    You seem to be describing security benefits of using the <base> tag. base-uri does not set the <base> element. It restricts the values that may be used for <base>. So setting the CSP base-uri value will not do what you said -- adding a <base> element will. Unless I am missing something. – jtpereyda Aug 2 '18 at 0:13
  • @jtpereyda I think you're overstating the benefits as well, a <base> tag doesn't limit what scripts can be included, it simply determines where relative paths will be included from. Absolute paths won't be affected. – AndrolGenhald Aug 2 '18 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.