0

I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I understand that this can help with XSS. But I read that this will disable inline CSS styles.

I have used inline CSS freely all over the website. Did not know this was a bad thing. (eg: div style="width:100%;"). If I was to find and transfer all inline CSS to file it would take too long.

However I am only taking input from user in 3 pages. One is a feedback form that stores data on server only. One is a contact form that does not store data only send an email(collects user email address). The comments page takes comment input, stores the data, it retrieves and displays entries that have been cleared by admin. The other pages are mostly displaying static content.

I'm assuming comments page is the priority (is this right?). Would it work if I put CSP declarations (? default-src: https:) to the above three pages only (and remove inline CSS). and the others have inline enabled (? default-src: https: 'unsafe-inline') ?

Improve this question

1 Answer 1

Reset to default
1

You can deploy your Content Security Policy in a way that is very restrictive to scripts, but still allows inline styles. The two directives to look out for are script-src and style-src.

Here is an example policy you might use:

default-src 'self';
script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https: 'report-sample';
style-src 'self' 'unsafe-inline';
object-src 'none';
base-uri 'none';
report-uri https://csp.example.com;

The thing about default-src is that it's supposed to be a fallback, in case that you did not specify something. In the above example policy, img-src is not defined, so it would be the same as the default-src.

Improve this answer
2
  • I see. Thanks. Its good to focus restricting scripts. Would there be a lot of risk in allowing inline styles in pages with the forms, and what is the risk of inline styles on static pages? Would like to clarify if only one policy is used for entire site or if policy can be changed for each page.
    – kanr
    Nov 8, 2019 at 11:50
  • Inline styles can be dangerous, which is why this should be considered a band-aid until the larger problem of "inline styles are used everywhere" is being fixed. I would suggest to use one policy for your site and not write different policies for each page.
    – user163495
    Nov 8, 2019 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .