0

I face a CSP header something like this -

default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline';

So is this is secure implementation?

This includes https: so should I consider that https://anyurlallowed?

Improve this question
3
  • 1
    Answer down below. I wanted to ask, what made you think this was secure?
    – user163495
    Dec 1, 2021 at 14:19
  • Thanks actually I wasn;t 100% sure what exactly https: means.
    – Cloud Learner
    Dec 1, 2021 at 14:22
  • You can find proper documentation here
    – user163495
    Dec 1, 2021 at 14:56

1 Answer 1

Reset to default
2

No, this is not safe.

The fact that your script-src includes 'unsafe-inline' and 'unsafe-eval' means that it provides no defense against Cross-Site Scripting.

Furthermore, https: does indeed mean it allows inclusion of any source using https, such as https://attackercontrolleddomainfromwhichyoudefinitelyshouldneverexecuteanyjavascriptfrom.com

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.