2

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used.

Content-Security-Policy: report-uri https://www.example.com

Does the above directive where only report-uri is used works fine and prevent any violations? Or report-uri is used only along with default-src directives?

1 Answer 1

2

A Content Security Policy allows you to define different types of directives, such as "fetch directives" and "reporting directives." Fetch directives control the locations from which certain resource types may be loaded. Reporting directives control the reporting process of CSP violations.

Does the above directive where only report-uri is used works fine and prevent any violations?

Your CSP doesn't define any fetch directives. It doesn't control any locations for resource types, so it doesn't prevent any violations in terms of the CSP itself.

Or report-uri is used only along with default-src directives?

In general, you need to define at least one fetch directive (such as default-src) so that your reporting directive (such as report-uri) might report violations.

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.