Questions tagged [content-security-policy]
This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].
166
questions
0
votes
0answers
32 views
Vulnerability detection tool that scans for dynamic script tag appending to DOM
I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script's URL isn't properly secured and my.remote.domain.com isn't whitelisted as an allowed domain to load and ...
0
votes
0answers
25 views
Example of script-src-attr that is not already handled by script-src-elem
What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don't want ...
0
votes
1answer
46 views
Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]
I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
2answers
85 views
Noob question on security of localhost
This may already have been answered, but I'm having difficulty understanding the technical jargon of various posts.
I have to give a Callback URL to receive some sort of validation, to use an API. ...
1
vote
0answers
69 views
Prevent XSS in 3rd party (self hosted) application
We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
0
votes
2answers
96 views
Content Security Policy [closed]
I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak.
I also see that the implementation of the CSP is ...
0
votes
1answer
41 views
image blocked by CSP policy even though the image is never requested
The following CSP directive violation is reported:
[csp-report]
(
[document-uri] => https://mysite.com/my-page/
[referrer] => https://www.google.com/
[violated-...
0
votes
1answer
50 views
Is using a server as bridge secure enough to protect the end data?
It comes to my mind a security problem that I would have accessing some data. My current problem is the following:
There is a server in AWS London where you can access some data,
by law, that data ...
0
votes
2answers
81 views
Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?
I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser.
A last line of ...
0
votes
0answers
30 views
Content from external sources still visible after applying CSP
I've added CSP layer of security in my application.
Now in chrome's web inspector, I can see CSP header in every web service response:
Content-Security-Policy: default-src 'self' *.intranet.myhost.com
...
1
vote
0answers
44 views
chrome-extension as source of CSP policy violation
Here is an extract from a CSP report
[csp-report] => Array
(
[blocked-uri] => chrome-extension
[column-number] => 27329
[document-uri] => https://www.mysite.com/...
2
votes
2answers
242 views
Why only script-src unsafe-inline is reported as a high severity finding?
I'm evaluating a CSP policy using https://csp-evaluator.withgoogle.com/. The policy is configured as follow:
default-src 'self';object-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';script-...
0
votes
1answer
115 views
CSP allowing Base64 encoded images without unsafe-eval
If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data ...
1
vote
0answers
54 views
Safely render HTML template with inline CSS from trusted domain (it forces the use of “style-src: unsafe-inline” in CSP)
I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
2
votes
2answers
95 views
Reverse tabnabbing: why not redirect the user in the new tab itself instead of the parent tab?
I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly ...
2
votes
2answers
224 views
What is the behaviour of CSP if default-src not specified?
Basically all in the title.
Imagine a simple CSP like
Content-Security-Policy: script-src 'self'
What is the behaviour of directives that would normally fall back to default-src which are not ...
1
vote
1answer
77 views
Is it possible to bypass malformed Content Security Policy missing quotes?
I found a website that has a very strict but malformed Content Security Policy of the form:
Content-Security-Policy: script-src none
which should actually be
Content-Security-Policy: script-src 'none'...
0
votes
2answers
123 views
Does CSP mitigate against client prototype pollution XSS and DOM XSS?
DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
2
votes
1answer
85 views
Content-Secure-Policy headers
I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
0
votes
2answers
207 views
What do I risk if I use CSP header style-src-attr 'unsafe-hashes' <hash>
I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>
in my CSP header.
I need to allow an external script to run, and it uses the style attribute on some ...
0
votes
1answer
70 views
Save encrypted data in server . With no way for server to read actual data
Hello i am developing an app that collects some private data from my clients. My clients wont like it if i am able to read the data. So the data is encrypted in cleint side with a key say "xyz&...
0
votes
1answer
63 views
Is https://div.show/options fraud/malware? [closed]
Is https://div.show/options fraud/malware? I saw via https://app.uriports.com that a customer tried to load the page mentioned before and it was blocked thanks to CSP.
0
votes
0answers
131 views
Which security headers should be sent with static files such as css/js/images
Of the security headers listed here: https://owasp.org/www-project-secure-headers/ which ones should be sent with static files (css, js, images etc) and what does setting them each achieve in that ...
1
vote
0answers
178 views
Do object-src and base-uri bypasses still work on Content-Security-Policies?
I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header:
Content-...
2
votes
0answers
133 views
Understanding CSP: report shows blocked <script> that shouldn't have been blocked
I'm having trouble making sense of some reported CSP violations that don't seem to actually be violations according to the CSP standard. I have not managed to reproduce the violations in my own ...
1
vote
1answer
78 views
Is nonce useless when user input is reflected within an inline script?
I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.
The script tag does have a nonce attribute.
As am working on bypassing the XSS filter, I had ...
3
votes
2answers
61 views
Serving “less trusted” content on the same domain
Let's say we run a web app at "example.org". It uses cookies for user authentication.
Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
0
votes
0answers
141 views
CSRF token not sent when calling the back-end?
My system composes of NuxtJs and AdonisJs application.
Adonis handles csrf tokens for us by sending:
set-cookie: adonis-session=XXX; Path=/; HttpOnly
set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
1
vote
1answer
115 views
CSP Violation ms-appx-web://
We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this:
base-uri 'self'; child-src 'self'; form-...
1
vote
1answer
234 views
3D secure 2 and CSP
I'm building a checkout page for a website and have a checkout page with a content security policy (CSP).
When the customer pays with a card, they will see a box popup with the bank page that allows ...
0
votes
1answer
52 views
Error on Content Security Policy while testing for Clickjacking
I was recently testing for Clickjacking and when I opened developer tools, I was warning
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source ...
1
vote
1answer
139 views
Enabling HTTP Security headers in S/4 Hana web applications
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
0
votes
0answers
31 views
Security Benefits of Having a Content Security Policy for a Domain Loaded through iframe
Consider the below scenario:
There's a checkout webpage that can be accessed at checkout.example.com. This page has decent security policy. But just to prevent any credit card info leakage, credit ...
0
votes
1answer
48 views
Content-Security-Policy (CSP) HTTP Header useful for direct link to image?
Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?
0
votes
0answers
31 views
Are there any known attacks against a dynamically inserted Content Security Policy?
Taking the example of an HTML page with meta elements. You could either define the CSP in the meta tags of the HTML, or use JavaScript to insert a new meta element as a sibling of the existing meta ...
2
votes
4answers
1k views
Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?
I have a website developed using VueJS (i.e. its a single page application). I've been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I ...
0
votes
0answers
33 views
Is there a way to limit cookies to certain hosts in HTTP?
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
2
votes
1answer
197 views
CSP is not enforced inside Web Worker
A CSP response header is set on the web worker JS file, but it is not enforced by the browser. The CSP is enforced in the Web worker only if the parent document's response header contains the CSP ...
0
votes
0answers
100 views
CSP header img-src data: without URI
I am testing application with CSP header like this:
Content-Security-Policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css ;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:/...
1
vote
1answer
38 views
Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?
I would like to block the execution of any instance of CSS's url() function in CSS provided by my server. One promising method would be a CSP, but I'm not sure if this is possible using a CSP. Is it? ...
0
votes
0answers
208 views
CSP: any way to prevent inline scripts dynamically created by a trusted external script?
Let's say I have a simple web application which uses a single JavaScript (JS) file, loaded from its own domain, and has implemented the restrictive Content Security Policy (CSP) of default-src 'self'. ...
0
votes
1answer
68 views
Security headers in application vs. Tomcat default 40x error
I would like to assess the actual risk for various CORS attacks when a web application properly sets CSP and other response headers, but the app server error page does not. When a 40x can be provoked ...
0
votes
1answer
431 views
WYSIWYG Rich text editor and renderer with no XSS risks
In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
0
votes
0answers
93 views
Why CSP vs XSS?
I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS -- why is it a solution?
My reason for asking this question stems ...
1
vote
1answer
144 views
Best Firewall Zone Settings for Security Gli-net Routers
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the ...
2
votes
2answers
832 views
NONCE not supported in Asp.Net for CSP implementation
Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ??
I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
3
votes
1answer
305 views
Why is CSP require-sri-for marked as obsolete?
The description from Mozilla warns that require-sri-for is obsolete and may be removed at any time.
The feature seems useful, especially for large websites where it's likely that a developer may ...
5
votes
1answer
909 views
What was the real reason for dropping reflected-xss directive from CSP?
There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past.
X-XSS Protection: 1; mode=block
...
5
votes
1answer
291 views
Why does Chrome claim that this stylesheet violates the Content Security Policy?
I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server.
I wanted to write my Content Security Policy in a way to permit all local ...
9
votes
1answer
1k views
Content Security Policy Style Hash
I have an img tag on a page with an line style that looks like this:
style="height:50px;width:180px;display:block;"
I can't move it to an external stylesheet because the img tag is generated by a ...
