Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
user avatar
  • 1
0 votes
0 answers
24 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
user avatar
  • 1
0 votes
1 answer
38 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
user avatar
  • 412
3 votes
1 answer
160 views

Report-URI CSP Directive

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used. Content-Security-Policy: report-uri https://www.example.com Does the above ...
user avatar
0 votes
0 answers
27 views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
user avatar
0 votes
1 answer
222 views

CORS request is not sending Authorization: Bearer <value> header

When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header. ...
user avatar
1 vote
1 answer
75 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
user avatar
0 votes
1 answer
49 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
user avatar
  • 3
0 votes
1 answer
65 views

Is this CSP implementation is secure?

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...
user avatar
0 votes
0 answers
55 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
user avatar
4 votes
1 answer
328 views

Is CSP meant to be used with HTTPS (TLS) only?

If a site uses HTTP and not HTTPS, is it useful to include a Content Security Policy? Can an adversary not just remove it?
user avatar
  • 143
0 votes
1 answer
203 views

Content Security Policy (CSP) - why does a JS file have multiple hashes?

I'm looking at my browser's console and I see the following error: These all pertain to the same JS file. I'm trying to figure out what's the quickest way to make these error go away. I'm guessing I ...
user avatar
0 votes
1 answer
97 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
user avatar
0 votes
0 answers
77 views

How can an external js file be securely added to a jinja2 template with csp?

Recently started with web security and came across to CSP. The idea is to implement js file to base jinja2 template and to use it on one of the templates. <script type="text/javascript" ...
user avatar
1 vote
0 answers
169 views

Google CSP Evaluator and style-src 'unsafe-inline'

Google provides a CSP evaluator to validate if a given content-security policy is well set up (https://github.com/google/csp-evaluator, https://csp-evaluator.withgoogle.com/). However, if one uses '...
user avatar
  • 11
0 votes
0 answers
81 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
user avatar
0 votes
1 answer
189 views

HTML Object Tag

In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
user avatar
0 votes
1 answer
200 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
user avatar
2 votes
2 answers
129 views

Can a Content Security Policy (CSP) enable *new* unsafe behavior?

Does the design and implementation of the content security policy standard allow for the introduction of new unsafe behavior that wasn't there prior to having any CSP at all? For example if my ...
user avatar
  • 123
0 votes
3 answers
124 views

On what types of web content is a Content-Security-Policy useful?

The W3C spec for Content-Security-Policy or Mozilla CSP docs would be the definitive source for this answer, but it does not seem covered, so I'm asking here for answers based on people's experience. ...
user avatar
6 votes
2 answers
872 views

Content Security Policy https: and data: meaning

I am having trouble finding information on the implications of using https: and data: as a source for the directives in a CSP. Example: img-src 'self' https: data:; Could someone some context around ...
user avatar
  • 171
2 votes
3 answers
617 views

When is content security policy (CSP) not appropriate?

We've recently conducted a security review of our identity server website and one of the finding was about missing CSP header. We do have implementation of request filter to add CSP on a controller ...
user avatar
1 vote
1 answer
342 views

Example of script-src-attr that is not already handled by script-src-elem

What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don't want ...
user avatar
0 votes
1 answer
170 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
user avatar
1 vote
2 answers
257 views

Noob question on security of localhost

This may already have been answered, but I'm having difficulty understanding the technical jargon of various posts. I have to give a Callback URL to receive some sort of validation, to use an API. ...
user avatar
1 vote
0 answers
125 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
user avatar
0 votes
2 answers
158 views

Content Security Policy [closed]

I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak. I also see that the implementation of the CSP is ...
user avatar
0 votes
1 answer
163 views

image blocked by CSP policy even though the image is never requested

The following CSP directive violation is reported: [csp-report] ( [document-uri] => https://mysite.com/my-page/ [referrer] => https://www.google.com/ [violated-...
user avatar
0 votes
1 answer
88 views

Is using a server as bridge secure enough to protect the end data?

It comes to my mind a security problem that I would have accessing some data. My current problem is the following: There is a server in AWS London where you can access some data, by law, that data ...
user avatar
  • 111
0 votes
2 answers
155 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
user avatar
1 vote
0 answers
177 views

chrome-extension as source of CSP policy violation

Here is an extract from a CSP report [csp-report] => Array ( [blocked-uri] => chrome-extension [column-number] => 27329 [document-uri] => https://www.mysite.com/...
user avatar
2 votes
2 answers
798 views

Why only script-src unsafe-inline is reported as a high severity finding?

I'm evaluating a CSP policy using https://csp-evaluator.withgoogle.com/. The policy is configured as follow: default-src 'self';object-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';script-...
user avatar
  • 477
1 vote
1 answer
473 views

CSP allowing Base64 encoded images without unsafe-eval

If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data ...
user avatar
1 vote
0 answers
147 views

Safely render HTML template with inline CSS from trusted domain (it forces the use of "style-src: unsafe-inline" in CSP)

I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
user avatar
  • 11
2 votes
2 answers
195 views

Reverse tabnabbing: why not redirect the user in the new tab itself instead of the parent tab?

I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly ...
user avatar
3 votes
2 answers
853 views

What is the behaviour of CSP if default-src not specified?

Basically all in the title. Imagine a simple CSP like Content-Security-Policy: script-src 'self' What is the behaviour of directives that would normally fall back to default-src which are not ...
user avatar
1 vote
1 answer
239 views

Is it possible to bypass malformed Content Security Policy missing quotes?

I found a website that has a very strict but malformed Content Security Policy of the form: Content-Security-Policy: script-src none which should actually be Content-Security-Policy: script-src 'none'...
user avatar
  • 1,134
0 votes
2 answers
289 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
user avatar
  • 101
2 votes
1 answer
157 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
user avatar
0 votes
2 answers
615 views

What do I risk if I use CSP header style-src-attr 'unsafe-hashes' <hash>

I'm wondering if I'm risking anything if I use style-src-attr 'unsafe-hashes' <hash> in my CSP header. I need to allow an external script to run, and it uses the style attribute on some ...
user avatar
0 votes
1 answer
105 views

Save encrypted data in server . With no way for server to read actual data

Hello i am developing an app that collects some private data from my clients. My clients wont like it if i am able to read the data. So the data is encrypted in cleint side with a key say "xyz&...
user avatar
  • 3
0 votes
1 answer
114 views

Is https://div.show/options fraud/malware? [closed]

Is https://div.show/options fraud/malware? I saw via https://app.uriports.com that a customer tried to load the page mentioned before and it was blocked thanks to CSP.
user avatar
  • 109
1 vote
0 answers
505 views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
user avatar
  • 187
2 votes
0 answers
252 views

Understanding CSP: report shows blocked <script> that shouldn't have been blocked

I'm having trouble making sense of some reported CSP violations that don't seem to actually be violations according to the CSP standard. I have not managed to reproduce the violations in my own ...
user avatar
1 vote
1 answer
139 views

Is nonce useless when user input is reflected within an inline script?

I stumbled upon a web app which is accepting user input and putting it into a variable within script tag. The script tag does have a nonce attribute. As am working on bypassing the XSS filter, I had ...
user avatar
  • 373
3 votes
2 answers
106 views

Serving "less trusted" content on the same domain

Let's say we run a web app at "example.org". It uses cookies for user authentication. Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
user avatar
1 vote
1 answer
220 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...
user avatar
  • 123
1 vote
1 answer
806 views

3D secure 2 and CSP

I'm building a checkout page for a website and have a checkout page with a content security policy (CSP). When the customer pays with a card, they will see a box popup with the bank page that allows ...
user avatar
0 votes
1 answer
111 views

Error on Content Security Policy while testing for Clickjacking

I was recently testing for Clickjacking and when I opened developer tools, I was warning Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source ...
user avatar
1 vote
1 answer
443 views

Enabling HTTP Security headers in S/4 Hana web applications

We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
user avatar