2

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags would be reflected back in full and execute a javascript alert...simple stuff. I included a basic CSP header:

Content-Security-Policy: default-src 'self'

I assumed this would stop the XSS, due to "CSP solves this problem by banning inline script entirely" https://developers.google.com/web/fundamentals/security/csp/

But, the js alert is still popping. I was able to verify that the header is being returned in the server response as expected. I tested with several up-to-date browsers (chrome, firefox, ie11). I applied the header in iis as follows:

# IIS Web.config
<system.webServer>
    <httpProtocol>
        <customHeaders>
            <add name="Content-Security-Policy" value="default-src 'self';" />
        </customHeaders>
    </httpProtocol>
</system.webServer>

Is my implementation incorrect, or are my expectations wrong here?

Improve this question
5
  • Could you add the source of the example page you were using to the question?
    – Matthew
    Nov 19, 2018 at 15:04
  • Unfortunately, this test app is a shared project, that I can't get too specific into the source. Any idea from a general perspective?
    – Frostbyte
    Nov 19, 2018 at 16:17
  • I tested: IE: 11.1387.15063.0 Firefox: 62.0 Chrome: 69.0.3497.100
    – Frostbyte
    Nov 19, 2018 at 16:26
  • I just tried this on latest Chrome and it was correctly blocked. In dev tools you can see "Refused to execute inline script because it violates the following Content Security Policy directive" I suspect the header isn't appearing on the right page for some reason. Check it with an intercepting proxy.
    – paj28
    Nov 19, 2018 at 16:36
  • Thanks paj28, this pointed me in the right direction! Turns out it was working in chrome (albeit, blocking more than I wanted!), but needed dev tools to confirm. IE was not working, but, does ie11 even support this header? This link mentions no support on ie10 but is dark on ie11. developer.mozilla.org/en-US/docs/Web/HTTP/CSP
    – Frostbyte
    Nov 19, 2018 at 17:19

2 Answers 2

Reset to default
4

[from comment] ... IE was not working, but, does ie11 even support this header?

According to can i use content security policy there is only partial support in IE11: only the sandbox directive is supported and the header needs to be specified as X-Content-Security-Policy. Thus, no support in IE11 for what you are trying to do.

Improve this answer
0

As Steffen mentioned, CSP is not fully supported on IE 11. Your code was definitely not wrong from my perspective (particularly given it was fine in Chrome).

This tool for checking CSP compatibility may prove useful in the future: https://content-security-policy.com/browser-test/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.