2

Is it possible to specify source list values based on the script src. The RFC mentions it, but I'm not sure about its usage.

For example:

Content-Security-Policy:default-src *; script-src 'unsafe-inline' 'self';
Content-Security-Policy:script-src 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com/*';

This combination means to disallow unsafe-eval everywhere except the Google Map APIs (which needs that).

If not then, it really means that apps have to remove unsafe-eval for everything just because a service like Google Maps needs it. I'm not sure if nonces can be used for this type of situations.

5

Unfortunately that is not how it works.

In your example,

Content-Security-Policy:default-src *; script-src 'unsafe-inline' 'self';
Content-Security-Policy:script-src 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com/*';

'unsafe-eval' https://maps.googleapis.com/*' are both sources. It is not stating that unsafe-eval is allowed on maps.googleapis.com, it is stating that unsafe-eval is allowed everywhere.

However, as your first header only states script-src 'unsafe-inline' 'self' this will effectively remove the 'unsafe-eval' https://maps.googleapis.com/*' from your second directive. This is the same as only specifying unsafe-inline. Each source needs to pass through both policies "unscathed".

Note that you cannot specify a wildcard the way you have. Check here for a clear explanation. You need https://maps.googleapis.com instead.

Nonces cannot be used to solve this because there is no static inline script - eval means it is all determined at run time by the browser.

I would suggest you only output the 'unsafe-eval' https://maps.googleapis.com part of the CSP directive on pages that require Google maps, as part of a single header output to the page.

  • Ah I see. In my context, the app is a single page app, so I think it might get enabled everywhere. – Akshay Rawat May 8 '15 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.