Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used.
Content-Security-Policy: report-uri https://www.example.com
Does the above directive where only report-uri is used works fine and prevent any violations? Or report-uri is used only along with default-src directives?
A Content Security Policy allows you to define different types of directives, such as "fetch directives" and "reporting directives." Fetch directives control the locations from which certain resource types may be loaded. Reporting directives control the reporting process of CSP violations.
Does the above directive where only report-uri is used works fine and prevent any violations?
Your CSP doesn't define any fetch directives. It doesn't control any locations for resource types, so it doesn't prevent any violations in terms of the CSP itself.
Or report-uri is used only along with default-src directives?
In general, you need to define at least one fetch directive (such as default-src) so that your reporting directive (such as report-uri) might report violations.
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
