Questions tagged [content-security-policy]
This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].
123
questions
0
votes
0answers
38 views
NONCE not supported in Asp.Net for CSP implementation
Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ??
I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
0
votes
0answers
28 views
Correct CSP frame-src value for iframes with empty src value
We have below CSP derivatives defined in our site,
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com; style-src 'self' 'unsafe-inline'; frame-src *.facebook.com www.youtube.com;
As ...
2
votes
1answer
79 views
Why is CSP require-sri-for marked as obsolete?
The description from Mozilla warns that require-sri-for is obsolete and may be removed at any time.
The feature seems useful, especially for large websites where it's likely that a developer may ...
5
votes
1answer
119 views
What was the real reason for dropping reflected-xss directive from CSP?
There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past.
X-XSS Protection: 1; mode=block
...
5
votes
1answer
279 views
Why does Chrome claim that this stylesheet violates the Content Security Policy?
I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server.
I wanted to write my Content Security Policy in a way to permit all local ...
8
votes
1answer
185 views
Content Security Policy Style Hash
I have an img tag on a page with an line style that looks like this:
style="height:50px;width:180px;display:block;"
I can't move it to an external stylesheet because the img tag is generated by a ...
0
votes
1answer
48 views
XSS and Content Security Policy, and existing CSS
I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
-1
votes
2answers
60 views
How does a Content Security Policy help with preventing XSS and other injection vulnerabilities? [closed]
I was reading up on CSP's and I did some testing on a site which had one implemented, I found an xss vulnerability even though it was using a CSP.
2
votes
1answer
57 views
Off the shelf JavaScript based CSP alternative - is it safe?
Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest ...
1
vote
1answer
79 views
In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision?
So in a CSP like the below:
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Should the url part be quoted like this (example from mozilla ...
1
vote
2answers
83 views
How safe is it to allow JS CDNs in a HTTP content security policy?
I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
0
votes
1answer
122 views
Content Security Policy (CSP) alternatives
Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline ...
0
votes
0answers
66 views
How to make a HTTPrequest in JSONP callback?
I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like:
<script src="https://whitelisted.jsonp?callback=...
1
vote
0answers
30 views
CSP for iFrame without any src attribute
I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
0
votes
0answers
26 views
Accessing a permitted file from local file system securely
I am working on project which has more focus on user data security. Public key cryptography is being used in this and private key is getting stored to user device locally (computer local file system). ...
1
vote
1answer
78 views
Is using default-src * safe?
I have a website to do security testing. The CSP is as follows.
default-src * ;
style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
1answer
103 views
Zero Day Policies implementation
I'm new here, and sorry if my english is a little bit broken it's not my main language.
I'm trying to put together a document/ppt for my startup with a Zero Day policy structure.
But I'm not finding ...
4
votes
1answer
2k views
CSP: What is script-src-attr and script-src-elem?
script-src-attr and script-src-elem directives are new additions in CSP3.
I am not able to understand how are they different from the script-src directive.
https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
136 views
HSTS preload and requisites on domain - subdomains must be added too?
I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/
However the ...
3
votes
1answer
157 views
Why does Adobe recommend not setting CSP headers for its web fonts?
In this help site, Adobe recommends not setting CSP for web fonts saying:
The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain.
and
...
1
vote
1answer
365 views
Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?
Ever since CSP 3 introduced strict-dynamic, Google has recommended its usage. Indeed, the idea of maintaining one "root" script, which in turn loads all other necessary scripts, sets up event handlers,...
1
vote
1answer
140 views
If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?
If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
1answer
86 views
Where can I configure certificate rules on Windows 10?
This excellent SSO answer recommends to use certificate rules on Windows’ executables, as explained here by Microsoft. The latter says that the “location” of this setting is:
Computer Configuration\...
2
votes
1answer
137 views
Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?
Here is an example of the CSP of accounts.google.com:
content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
2
votes
1answer
334 views
Content Security Policy: postMessage into foreign iframe
Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
1
vote
0answers
216 views
How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?
For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
1
vote
1answer
955 views
Does CSP block javascript in <a href> tags?
I recently discovered that its possible to run javascript from an <a> tag like this
<a href="javascript:alert('test')">
and this gets run on the current page when clicked. It also seems ...
1
vote
2answers
2k views
Prevent javascript cross-origin redirect by window.location.href
Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted?
const form = document.getElementsByTagName('form')[0];
form.addEventListener('submit', ...
24
votes
4answers
8k views
Can I trust public code versioning platforms when building a social platform?
We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions.
We are currently limited on resources, both ...
1
vote
1answer
65 views
Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP?
Some websites use Content-Security-Policy nonces in order to include inline styling and script in their webpages.
Is the CSP nonce feature designed to be used for production use, or is it simply ...
0
votes
1answer
2k views
CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not
Following is a CSP policy, for example derived sample response headers.
The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
1answer
150 views
Prevent javascript cross-origin write
Let's assume an attacker manages to inject this script in a login page:
const form = document.getElementsByTagName('form')[0];
form.addEventListener('submit', stealCredentials);
function ...
2
votes
1answer
71 views
is there a low-overhead way to log every new file created on a Linux host?
I know about inotify but am concerned it would use too many resources.
Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
3
votes
2answers
558 views
Does allowing unsafe-inline script defeat the purpose of CSP?
I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website).
Content-Security-Policy: "default-src '...
2
votes
2answers
335 views
Content Security Policy Header not stopping attack
I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
5
votes
3answers
307 views
How to safely allow scripts but preventing XSS?
We are trying to find the best way to allow JavaScript in a web application while being safe against XSS.
Site admins have the privilege to insert JavaScript to control the site templates, and ...
2
votes
0answers
393 views
What are the dangers of “style-src: 'unsafe-inline'”? [duplicate]
This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
1
vote
0answers
437 views
Data image with CSP
I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that.
Because it is called from within ...
2
votes
1answer
76 views
CSP to report HTTP resources?
I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of ...
4
votes
1answer
856 views
How do I control multiply-nested embedding of my iframe?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
6
votes
1answer
3k views
What's the alternative of content security policy (CSP) header in Internet Explorer IE?
As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our ...
1
vote
1answer
142 views
Do we need to add CSP to all web pages in a web application?
We have a multi-page web application. I understand that ideally CSP should be set for text/html responses only. Is it enough to add content security policy (CSP) header to the login page or should I ...
1
vote
2answers
823 views
What attacks does Content Security Policy base-uri protect against?
I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
4
votes
0answers
1k views
Is allowing blob: in Content-Security-Policy a risk?
Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
0
votes
2answers
137 views
Best way to encrypt user data stored in xml?
First of all I am not very familiar with the world of encryption so please be nice.
I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
2
votes
0answers
311 views
"Protection Mechanism Failure (CWE ID 693)
After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application.
Our current header is set as mentioned below-
Server: Apache X-Frame-Options: SAMEORIGIN ...
1
vote
0answers
37 views
How to protect the control environment of my web application? [closed]
I am developing a web application and want to do its setup and control using my personal notebook.
However, the following topics concern me:
1) Enter the platform (includes the login in the control ...
17
votes
1answer
793 views
Is it safe to send Content-Security-Policy header for text/html content-type only?
Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets -...
2
votes
1answer
448 views
Content-Security-Policy suspicious entries in the log
I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src for suspicious URLs:
https://...
0
votes
1answer
496 views
CSP header default-src: data:
I am testing CSP header implementation. The implemented header value is:
Content-Security-Policy: default-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-...
