2

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing such a case and I would like to know: Are these two headers equivalent?

Will browsers be able to recognize this Content-Secure-Policy?

3
  • 1
    I've looked through header documentation and googled around. It appears to be not an uncommon header in use but I cannot confirm what a browser will do with it.
    – schroeder
    Commented Oct 21, 2020 at 19:47
  • 1
    I would suggest that this is a typo. It was probably not tested, if the attempted security policy actually works as expected. Commented Oct 21, 2020 at 20:02
  • Did you test the site to see if the misspelled CSP is actually doing anything? Should be easy with Burp Suite or similar; just try and add an element with a disallowed origin or otherwise in violation of the CSP, and see if the browser attempts to fetch it.
    – CBHacking
    Commented Nov 20, 2022 at 1:49

1 Answer 1

2

They are not equivalent.

The W3C Draft for CSP only defines the headers Content-Security-Policy and Content-Security-Policy-Report-Only. No other headers are defined by the document.

That means browsers can choose to include this specific typo, but it is unlikely that browser vendors will attempt to predict all possible ways to misspell Content-Security-Policy in order to improve compatibility.

How to proceed now?

Mark it as a finding, stating that their CSP header is malformed and will likely be ignored by browsers. Fixing it should not be difficult anyways. If the developers state that some arbitrary browser they tested this on still works with it, you can still mention that it's not covered in any draft and is implementation-specific behavior - and thus a risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .