Questions tagged [content-security-policy]
Content Security Policy is a mechanism for mitigating attacks against web applications.
0
votes
1answer
34 views
CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not
Following is a CSP policy, for example derived sample response headers.
The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
1answer
49 views
Prevent javascript cross-origin write
Let's assume an attacker manages to inject this script in a login page:
const form = document.getElementsByTagName('form')[0];
form.addEventListener('submit', stealCredentials);
function ...
-1
votes
0answers
80 views
“Content-Security-Policy” HTTP Header with “default-src 'self'; script-src 'self'” not blocking downloading of non specify domain
I am trying to only allow 'self' and 'https://cdn.jsdelivr.net' by using:
"add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net";
I encountered an ...
2
votes
1answer
36 views
is there a low-overhead way to log every new file created on a Linux host?
I know about inotify but am concerned it would use too many resources.
Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
3
votes
2answers
90 views
Does allowing unsafe-inline script defeat the purpose of CSP?
I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website).
Content-Security-Policy: "default-src '...
2
votes
2answers
114 views
Content Security Policy Header not stopping attack
I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
3
votes
1answer
108 views
How to safely allow scripts but preventing XSS?
We are trying to find the best way to allow JavaScript in a web application while being safe against XSS.
Site admins have the privilege to insert JavaScript to control the site templates, and ...
2
votes
0answers
49 views
What are the dangers of “style-src: 'unsafe-inline'”? [duplicate]
This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
1
vote
0answers
61 views
Data image with CSP
I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that.
Because it is called from within ...
2
votes
1answer
57 views
CSP to report HTTP resources?
I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of ...
2
votes
1answer
86 views
How do I control multiply-nested embedding of my iframe?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
3
votes
1answer
605 views
What's the alternative of content security policy (CSP) header in Internet Explorer IE?
As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our ...
1
vote
1answer
55 views
Do we need to add CSP to all web pages in a web application?
We have a multi-page web application. I understand that ideally CSP should be set for text/html responses only. Is it enough to add content security policy (CSP) header to the login page or should I ...
1
vote
2answers
164 views
What attacks does Content Security Policy base-uri protect against?
I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
1
vote
0answers
286 views
Is allowing blob: in Content-Security-Policy a risk?
Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
0
votes
2answers
82 views
Best way to encrypt user data stored in xml?
First of all I am not very familiar with the world of encryption so please be nice.
I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
2
votes
0answers
185 views
"Protection Mechanism Failure (CWE ID 693)
After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application.
Our current header is set as mentioned below-
Server: Apache X-Frame-Options: SAMEORIGIN ...
1
vote
0answers
36 views
How to protect the control environment of my web application? [closed]
I am developing a web application and want to do its setup and control using my personal notebook.
However, the following topics concern me:
1) Enter the platform (includes the login in the control ...
13
votes
1answer
438 views
Is it safe to send Content-Security-Policy header for text/html content-type only?
Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets -...
2
votes
1answer
275 views
Content-Security-Policy suspicious entries in the log
I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src for suspicious URLs:
https://...
0
votes
0answers
32 views
WebWorker Hash-Source CSP importScripts
I have been trying to move my site to hash-source CSP instead of host-source CSP to verify integrity of files distributed by a CDN.
I have a WebWorker running in the background, which imports a few ...
0
votes
1answer
200 views
CSP header default-src: data:
I am testing CSP header implementation. The implemented header value is:
Content-Security-Policy: default-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-...
0
votes
0answers
175 views
Single Page Application and CSRF Token generated every time
I need to use a Single Page Application (React, Ember, Angular, I don't care) with Rails CSRF protection mechanism.
I'm wondering if I need to create a token evey time in the ApplicationController ...
1
vote
1answer
252 views
SRI for CSP - how do I get the hash for inline code?
I have been messing about with website design for years, but I am no expert - more of a hardware junkie.
CSP is fascinating for me now that I am starting to branch out into web development. I was ...
5
votes
1answer
174 views
Can BeEF hooking be stopped with Content Security Policies
I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
0
votes
0answers
22 views
Are CSP violation reports available on page within a page as JS objects
I will be implementing a CSP on a large site soon and would love to integrate the violations into our existing MI/Reporting
I would really like if the report information was available within the page ...
0
votes
0answers
88 views
On Android, Is using “Custom URI Scheme” with “OAUTH 2.0” is secure?
Is anyone can register the same Custom URI Scheme (maybe a hacker), and if so how can i prevent other apps from registering the same Custom URI Scheme.
If there's good alternatives to Custom URI ...
3
votes
2answers
391 views
What does the CSP require-sri-for directive protect against?
According to Mozilla:
The HTTP Content-Security-Policy require-sri-for directive instructs the client to require the use of Subresource Integrity for scripts or styles on the page.
I fail to see ...
4
votes
3answers
2k views
Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?
In my Content Security Policy I have included require-sri-for script. However, in the Chrome console I get a notice (not an error, just info):
The Content-Security-Policy directive 'require-sri-for'...
2
votes
1answer
299 views
Does Chrome respect the X-DNS-Prefetch-Control header?
If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?:
<link rel="dns-prefetch" href="http://www.spreadfirefox.com/">
I know Firefox and Chromium ...
0
votes
3answers
86 views
Why doesn't CSP block JS from modifying an element's style?
You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing ...
5
votes
1answer
618 views
XSS vulnerability with strict CSP
The article I’m harvesting credit card numbers and passwords from your site. Here’s how. describes the phases of a theoretical attack where an attacker can bypass a strict CSP and exfiltrate sensitive ...
2
votes
1answer
65 views
Should I allow http script sources in my CSP, or enforce https only?
I'm currently trying to implement a third-party widget into my website. That widget attempts to load some scripts over http, which is currently disallowed by my content security policy.
I'm concerned ...
4
votes
1answer
164 views
Poor result on securityheaders.io for google.com
I have just tested google on securityheaders.io and the result was D.
Google is actually not setting following security headers
Content-Security-Policy
X-Content-Type-Options
Referrer-Policy
I ...
0
votes
1answer
52 views
How to perform attack that requires me to set a CSP on a site I do not control?
I am reading this blog post about an vulnerability on uber.com. It says that you will have to set a content security policy:
We’ll set our policy to only allow requests to partners.uber.com, which ...
3
votes
1answer
68 views
Is it possible to specify a content security policy in browsers?
Normally, content security policies are sent in the response headers by the server to the client browser telling it what is and is not acceptable to load on the site. Is there a way to do this in ...
0
votes
1answer
476 views
CSP report-uri does not work
I'm using the following PHP script to test CSP policy,
<?php
header("Content-Security-Policy: default-src https:; report-uri /report.php");
header("Content-Security-Policy: default-src 'self'...
2
votes
2answers
400 views
CSP: upgrade-insecure-requests - what happens with https-incompatible ressources?
I have two questions regarding the CSP directive upgrade-insecure-requests which I couldn't answer myself by reading the specification.
What happens to ressources which can't be upgraded to https (e....
5
votes
1answer
680 views
Content-Security-Policy: Getting weird reports with frame-ancestors 'self'
Right now, I maintain the Content-Security-Policy for https://www.lidl.de, which is:
Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/...
0
votes
2answers
451 views
What vulnerability do inline javascript and event handlers expose? [duplicate]
I'm trying to understand why certain CSPs block inline javascript. Is the concern that a user will be able to insert javascript that will then be served to other users? If so, isn't this an issue with ...
1
vote
0answers
449 views
HTTP security headers for native and webview based mobile applications
OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications?
HTTP Strict Transport Security (...
2
votes
1answer
237 views
Does an Embedded Content Security Policy (CSP) Enforcement ruin a “regular” CSP?
I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP).
This document defines a mechanism by which a web page can embed a nested browsing context if ...
1
vote
1answer
1k views
Bypass Content Security Policy: Using Form tag
This article talks about bypassing CSP using Form tags.
Edit: As suggested, details has to be provided in case the external link stops working.
So here are the details:
There is content-security-...
1
vote
1answer
291 views
Using Content Security Policy in AMP-HTML pages?
I have a site built with AMP. I tried to use Content-Security-Policy: script-src 'self', but all styles and designs didn't show properly since they are loaded from cdn.ampproject.org.
Google, in their ...
1
vote
0answers
33 views
Getting the following error: default-src 'none' [duplicate]
I'm making a game with a library called Processing.js. This library has two built in functions that allow me to save and retrieve information from a .txt file. But when I tried to use this functions ...
3
votes
1answer
468 views
CSP base-uri directive on “View page source” on
I am in the process of implementing a CSP header for a webapp, with the goal of reducing possible XSS attacks. See CSP for an overview of CSP. I provided the base-uri directive as 'self' and this ...
1
vote
2answers
701 views
Why are inline scripts and styles considered not secure under content security policy?
Inline scripts and styles are just a kind of language (CSS/Javascript) embedded in another langauge (HTML). Why are them not allowed by default under content security policy?
1
vote
1answer
360 views
If I use the require-sri-for CSP, will script and style loaded from my site remain accessible?
I use the following CSP rule:
Content-Security-Policy: require-sri-for script style
I know that if I load style and script from a CDN it will get blocked if I don't include their hash.
But if I ...
16
votes
2answers
4k views
Why is CSP needed to protect against img-src leak?
GitHub explains the problem with img-src in
"GitHub's post-CSP journey":
A tag with an unclosed quote will capture all output up to the next
matching quote. This could include security sensitive ...
4
votes
2answers
686 views
Securing Micro Services Architecture internally
I am implementing a solution with set of Micro Services (Spring Rest Services) with Rabbit MQ as the message broker. The Edge server is Authenticated using OAuth based Identity server. Internal ...
