Content Security Policy [closed]

Question

I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak.

I also see that the implementation of the CSP is similar to HSTS and you need to insert some CSP tags for its implementation.

So my questions are :

• Is CSP a minimal requirement for security on web poages?
• What is the impact of CSP on SEO?

Answer 1

It is of course possible to run a secure website without having a Content-Security-Policy. There are, however, some reasons it makes sense:

• First, if you configure it reasonably strictly, it's possible to make certain security problems, like cross-site scripting attacks, harder or nearly impossible. This does typically require eliminating inline scripts and restricting external scripts to load only from trusted domains.
• If you host user-generated content, such as user-generated SVGs, you may want to avoid that content from being used as a source of scripts or a generalized attack platform. Since documents (including SVGs) loaded from a domain with a suitable CSP won't be able to use JavaScript, you may feel more comfortable hosting them.
• You can also, more generally, require your pages to only function over HTTPS, since a robust CSP header will reject non-secure origins for loading external resources. Thus, a page accidentally loaded over HTTP would be devoid of images, scripts, and functional forms. While this would be a bad user experience, you'd at least avoid a lot of security problems in such a case.

I would say that now, in 2021, adding one is a best practice. Many sites do not, but because CSP headers do provide defense in depth for a wide variety of problems, it would be prudent to add one. I have no knowledge or interest in SEO and so couldn't speak to it, even it were on topic.

Answer 2

Content Security Policy (CSP) is much more than just XSS protection. CSP mitigates / eliminates the consequences of:

• insertion of third-party content (scripts, pictures) by Internet providers, see How a banner ad for H&R Block appeared on apple.com—without Apple’s OK, Comcast Wi-Fi serving self-promotional ads via JavaScript injection.
• insertion of third-party content by means of DNS spoofing, hosting hacking, see Ad-Fraud Malware Hijacks Router DNS – Injects Ads Via Google Analytics, Generating highly targeted traffic by replacing DNS and HTTP errors with relevant advertising
• insertion of third-party content (advertising) by malicious plugins or malware, see Extracting the SuperFish certificate, Out with unwanted ad injectors
• control of third-party scripts installed on the site (inserting ads, tracking pixels and tracking cookies, see AddThis social buttons inject tracking pixels - how to prevent this with CSP.
• the theft of traffic by dishonest advertisers, which, for example, through advertising Adsense, see Cutting unwanted ad injectors out of advertising

Therefore, you cannot create a secure web application without using a CSP.
CSP is de facto "Must Have", all Chrome and Firefox extensions / addons must have Content Security Policy.

What most of the sites don't implement it or the implementation is very weak it's mostly unknowingly and because of using third party libraries that require 'unsafe-inline'.