0

I have a Content-Security-Policy-Report-Only: header of:

default-src 'report-sample' 'self' *.googleapis.com; object-src 'none'; report-uri https://example.com/csp_logger;

but violations are being reported to my csp_logger endpoint, specifically:

blocked-uri: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js
violated-directive: script-src-elem

Why is this? The document URI serving the html that references https://ajax.googleapis.com is also https, so the protocols match. I would expect the default-src value of *.googleapis.com to have covered this case.

Does default-src not provide a fallback for script-src-elem?

EDIT: Ah, I see that https://stackoverflow.com/questions/64322419/why-is-script-src-elem-not-using-values-from-script-src-as-a-fallback has the same issue, and more detail, but no satisfactory answer.

EDIT2: I've installed the PrivacyBadger Chrome extension to try and see if I can replicate the results from the top voted answer to the question I referenced

These are useful resources too:

2

1 Answer 1

0

The CSP standard explicitly defines default-src as a fallback if script-src-elem and script-src are not defined.

So either your CSP header isn't correctly served, or this is a browser-specific problem. For the latter, there are a number of possible causes.

  • A browser extension which is messing with the CSP mechanism, as indicated by the Stackoverflow topic you've found.
  • A bug in the browser itself
  • An incomplete CSP implementation -- rather unlikely given this is a very basic feature

If you cannot find the cause, go through the usual debug steps.

  1. Create a minimal example which contains only the relevant code and nothing else.
  2. Use different browsers. Check whether they have the same issue. If they do, double-check that the correct CSP header is served.
  3. If it's only one browser, disable all browser extensions. Check if the problem persists.
  4. Update your browser. Check if the problem persists.
  5. If the issue is still there, file a bug report for the specific browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .