0

If my Content-Security-Policy is set to the following:

Content-Security-Policy: frame-ancestors 'self'

Does it also imply:

Content-Security-Policy: default-src 'self'

Or is it a lot safer to put both rules?

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'

Updated, as mentioned by AlphaD in a comment, the "same-origin" is indicated by default-src and not an hypothetical same-origin option. I updated my question accordingly.

Improve this question
2
  • 1
    When you write same-origin do you mean something like default-src 'self'? I don't think your CSP examples #2,#3 are valid syntax.
    – AlphaD
    Aug 25, 2021 at 7:55
  • @AlphaD Ah! I understand now. I found a couple of links that helped tremendously too. I updated my question to showing default-src 'self' too.
    – Alexis Wilke
    Aug 25, 2021 at 15:46

1 Answer 1

Reset to default
1

Okay, I found two documents that helped me answer my own question.

The page is specifically about the Content-Security-Policy header:

https://content-security-policy.com/

and it shows interesting examples of CSP.

Now on Mozilla, we have a default-src page which clearly explains that the default-src is the default for all the other ...-src options. Changing another option takes priority for that option. So in my example above, if I do:

Content-Security-Policy: default-src 'self'

then I do not need to add frame-ancestors 'self' since it will be the default already. However, just doing:

Content-Security-Policy: frame-ancestors 'self'

Does not affect the default-src, whatever that might be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .