Questions tagged [content-security-policy]
This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].
149
questions
0
votes
1answer
37 views
What do I risk if I use CSP header style-src-attr 'unsafe-hashes' <hash>
I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>
in my CSP header.
I need to allow an external script to run, and it uses the style attribute on some ...
0
votes
1answer
64 views
Save encrypted data in server . With no way for server to read actual data
Hello i am developing an app that collects some private data from my clients. My clients wont like it if i am able to read the data. So the data is encrypted in cleint side with a key say "xyz&...
-1
votes
0answers
32 views
Is this usual occurrence or SSRF?
if the url (generated by me on ngrok and listening to it) supplied in the blocked-uri parameter of another csp report submitted to a sentry server, is getting get requests from cache.google.com and ...
0
votes
1answer
52 views
Is https://div.show/options fraud/malware? [closed]
Is https://div.show/options fraud/malware? I saw via https://app.uriports.com that a customer tried to load the page mentioned before and it was blocked thanks to CSP.
0
votes
0answers
39 views
Which security headers should be sent with static files such as css/js/images
Of the security headers listed here: https://owasp.org/www-project-secure-headers/ which ones should be sent with static files (css, js, images etc) and what does setting them each achieve in that ...
1
vote
0answers
46 views
Do object-src and base-uri bypasses still work on Content-Security-Policies?
I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header:
Content-...
2
votes
0answers
62 views
Understanding CSP: report shows blocked <script> that shouldn't have been blocked
I'm having trouble making sense of some reported CSP violations that don't seem to actually be violations according to the CSP standard. I have not managed to reproduce the violations in my own ...
1
vote
1answer
62 views
Is nonce useless when user input is reflected within an inline script?
I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.
The script tag does have a nonce attribute.
As am working on bypassing the XSS filter, I had ...
3
votes
2answers
59 views
Serving “less trusted” content on the same domain
Let's say we run a web app at "example.org". It uses cookies for user authentication.
Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
0
votes
0answers
76 views
CSRF token not sent when calling the back-end?
My system composes of NuxtJs and AdonisJs application.
Adonis handles csrf tokens for us by sending:
set-cookie: adonis-session=XXX; Path=/; HttpOnly
set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
0
votes
0answers
33 views
CSP Violation ms-appx-web://
We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this:
base-uri 'self'; child-src 'self'; form-...
0
votes
0answers
61 views
3D secure 2 and CSP
I'm building a checkout page for a website and have a checkout page with a content security policy (CSP).
When the customer pays with a card, they will see a box popup with the bank page that allows ...
0
votes
1answer
43 views
Error on Content Security Policy while testing for Clickjacking
I was recently testing for Clickjacking and when I opened developer tools, I was warning
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source ...
1
vote
1answer
54 views
Enabling HTTP Security headers in S/4 Hana web applications
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
0
votes
0answers
30 views
Security Benefits of Having a Content Security Policy for a Domain Loaded through iframe
Consider the below scenario:
There's a checkout webpage that can be accessed at checkout.example.com. This page has decent security policy. But just to prevent any credit card info leakage, credit ...
0
votes
1answer
42 views
Content-Security-Policy (CSP) HTTP Header useful for direct link to image?
Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?
0
votes
0answers
31 views
Are there any known attacks against a dynamically inserted Content Security Policy?
Taking the example of an HTML page with meta elements. You could either define the CSP in the meta tags of the HTML, or use JavaScript to insert a new meta element as a sibling of the existing meta ...
1
vote
4answers
211 views
Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?
I have a website developed using VueJS (i.e. its a single page application). I've been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I ...
0
votes
0answers
32 views
Is there a way to limit cookies to certain hosts in HTTP?
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
2
votes
1answer
135 views
CSP is not enforced inside Web Worker
A CSP response header is set on the web worker JS file, but it is not enforced by the browser. The CSP is enforced in the Web worker only if the parent document's response header contains the CSP ...
0
votes
0answers
47 views
CSP header img-src data: without URI
I am testing application with CSP header like this:
Content-Security-Policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css ;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:/...
1
vote
1answer
35 views
Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?
I would like to block the execution of any instance of CSS's url() function in CSS provided by my server. One promising method would be a CSP, but I'm not sure if this is possible using a CSP. Is it? ...
0
votes
0answers
87 views
CSP: any way to prevent inline scripts dynamically created by a trusted external script?
Let's say I have a simple web application which uses a single JavaScript (JS) file, loaded from its own domain, and has implemented the restrictive Content Security Policy (CSP) of default-src 'self'. ...
0
votes
1answer
43 views
Security headers in application vs. Tomcat default 40x error
I would like to assess the actual risk for various CORS attacks when a web application properly sets CSP and other response headers, but the app server error page does not. When a 40x can be provoked ...
0
votes
1answer
143 views
WYSIWYG Rich text editor and renderer with no XSS risks
In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
0
votes
0answers
71 views
Why CSP vs XSS?
I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS -- why is it a solution?
My reason for asking this question stems ...
1
vote
1answer
82 views
Best Firewall Zone Settings for Security Gli-net Routers
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the ...
0
votes
1answer
320 views
NONCE not supported in Asp.Net for CSP implementation
Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ??
I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
0
votes
0answers
77 views
Correct CSP frame-src value for iframes with empty src value
We have below CSP derivatives defined in our site,
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com; style-src 'self' 'unsafe-inline'; frame-src *.facebook.com www.youtube.com;
As ...
3
votes
1answer
193 views
Why is CSP require-sri-for marked as obsolete?
The description from Mozilla warns that require-sri-for is obsolete and may be removed at any time.
The feature seems useful, especially for large websites where it's likely that a developer may ...
5
votes
1answer
540 views
What was the real reason for dropping reflected-xss directive from CSP?
There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past.
X-XSS Protection: 1; mode=block
...
5
votes
1answer
289 views
Why does Chrome claim that this stylesheet violates the Content Security Policy?
I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server.
I wanted to write my Content Security Policy in a way to permit all local ...
8
votes
1answer
749 views
Content Security Policy Style Hash
I have an img tag on a page with an line style that looks like this:
style="height:50px;width:180px;display:block;"
I can't move it to an external stylesheet because the img tag is generated by a ...
0
votes
1answer
84 views
XSS and Content Security Policy, and existing CSS
I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
-1
votes
2answers
75 views
How does a Content Security Policy help with preventing XSS and other injection vulnerabilities? [closed]
I was reading up on CSP's and I did some testing on a site which had one implemented, I found an xss vulnerability even though it was using a CSP.
2
votes
1answer
64 views
Off the shelf JavaScript based CSP alternative - is it safe?
Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest ...
1
vote
1answer
342 views
In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision?
So in a CSP like the below:
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Should the url part be quoted like this (example from mozilla ...
1
vote
2answers
110 views
How safe is it to allow JS CDNs in a HTTP content security policy?
I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
0
votes
1answer
248 views
Content Security Policy (CSP) alternatives
Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline ...
0
votes
0answers
156 views
How to make a HTTPrequest in JSONP callback?
I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like:
<script src="https://whitelisted.jsonp?callback=...
2
votes
0answers
46 views
CSP for iFrame without any src attribute
I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
1
vote
1answer
100 views
Is using default-src * safe?
I have a website to do security testing. The CSP is as follows.
default-src * ;
style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
1answer
106 views
Zero Day Policies implementation
I'm new here, and sorry if my english is a little bit broken it's not my main language.
I'm trying to put together a document/ppt for my startup with a Zero Day policy structure.
But I'm not finding ...
4
votes
1answer
4k views
CSP: What is script-src-attr and script-src-elem?
script-src-attr and script-src-elem directives are new additions in CSP3.
I am not able to understand how are they different from the script-src directive.
https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
259 views
HSTS preload and requisites on domain - subdomains must be added too?
I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/
However the ...
3
votes
1answer
324 views
Why does Adobe recommend not setting CSP headers for its web fonts?
In this help site, Adobe recommends not setting CSP for web fonts saying:
The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain.
and
...
2
votes
1answer
601 views
Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?
Ever since CSP 3 introduced strict-dynamic, Google has recommended its usage. Indeed, the idea of maintaining one "root" script, which in turn loads all other necessary scripts, sets up event handlers,...
1
vote
1answer
211 views
If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?
If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
1answer
144 views
Where can I configure certificate rules on Windows 10?
This excellent SSO answer recommends to use certificate rules on Windows’ executables, as explained here by Microsoft. The latter says that the “location” of this setting is:
Computer Configuration\...
2
votes
1answer
179 views
Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?
Here is an example of the CSP of accounts.google.com:
content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
