If a site uses HTTP and not HTTPS, is it useful to include a Content Security Policy? Can an adversary not just remove it?

New contributor
savx2 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    This is basically saying that anything send over plain HTTP is not useful since an attacker can replace it. This is true for the whole request and response header and body. CSP is no exception here. Nov 23 at 15:18

It depends on what the attacker is able to do.

As you know, it's possible for a HTTP request / response to be intercepted, and modified by an attacker. This attacker can then alter the response to remove the CSP.

But this requires the attacker to be able to intercept HTTP requests, which is, depending on the threat model, not the easiest attack vector to get.

Many attack vectors don't require intercepting the HTTP request at all, like clickjacking and XSS injections. CSP is still an effective defense against them.

Your Answer

savx2 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.