1

We have a multi-page web application. I understand that ideally CSP should be set for text/html responses only. Is it enough to add content security policy (CSP) header to the login page or should I add the header to each & every page?

Did not find any supporting csp documentation to check this.

3

I understand that ideally CSP should be set for text/html responses only.

It does not harm to set it on every other response too, especially if it could be tricked to be rendered in HTML context.

Is it enough to add content security policy (CSP) header to the login page or should I add the header to each & every page?

CSP gets only applied to the page where it is set. Thus if a CSP is only send for the login page it will not be applied to any other pages. Since this is probably not what you want you need to set it on every page.

Did not find any supporting csp documentation to check this.

MDN - Content Security Policy (CSP) - Using CSP says that CSP gets only used for the page where it is set:

Configuring Content Security Policy involves adding the Content-Security-Policy HTTP header to a web page and giving it values to control resources the user agent is allowed to load for that page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.