Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
0
votes
1answer
149 views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
1
vote
1answer
3k views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
1answer
39 views

Content-Security-Policy (CSP) HTTP Header useful for direct link to image?

Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?
3
votes
2answers
600 views

Using Content Security Policy in AMP-HTML pages?

I have a site built with AMP. I tried to use Content-Security-Policy: script-src 'self', but all styles and designs didn't show properly since they are loaded from cdn.ampproject.org. Google, in their ...
0
votes
0answers
29 views

Are there any known attacks against a dynamically inserted Content Security Policy?

Taking the example of an HTML page with meta elements. You could either define the CSP in the meta tags of the HTML, or use JavaScript to insert a new meta element as a sibling of the existing meta ...
1
vote
3answers
64 views

Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?

I have a website developed using VueJS (i.e. its a single page application). I've been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I ...
0
votes
0answers
31 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
0
votes
1answer
35 views

Security headers in application vs. Tomcat default 40x error

I would like to assess the actual risk for various CORS attacks when a web application properly sets CSP and other response headers, but the app server error page does not. When a 40x can be provoked ...
2
votes
1answer
116 views

CSP is not enforced inside Web Worker

A CSP response header is set on the web worker JS file, but it is not enforced by the browser. The CSP is enforced in the Web worker only if the parent document's response header contains the CSP ...
0
votes
0answers
28 views

CSP header img-src data: without URI

I am testing application with CSP header like this: Content-Security-Policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css ;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:/...
1
vote
1answer
31 views

Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?

I would like to block the execution of any instance of CSS's url() function in CSS provided by my server. One promising method would be a CSP, but I'm not sure if this is possible using a CSP. Is it? ...
0
votes
0answers
60 views

CSP: any way to prevent inline scripts dynamically created by a trusted external script?

Let's say I have a simple web application which uses a single JavaScript (JS) file, loaded from its own domain, and has implemented the restrictive Content Security Policy (CSP) of default-src 'self'. ...
0
votes
1answer
71 views

WYSIWYG Rich text editor and renderer with no XSS risks

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
11
votes
3answers
2k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
0
votes
0answers
64 views

Why CSP vs XSS?

I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS -- why is it a solution? My reason for asking this question stems ...
4
votes
1answer
3k views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
1
vote
1answer
68 views

Best Firewall Zone Settings for Security Gli-net Routers

I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel. What would be the ...
0
votes
0answers
53 views

Correct CSP frame-src value for iframes with empty src value

We have below CSP derivatives defined in our site, script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com; style-src 'self' 'unsafe-inline'; frame-src *.facebook.com www.youtube.com; As ...
2
votes
1answer
147 views

Why is CSP require-sri-for marked as obsolete?

The description from Mozilla warns that require-sri-for is obsolete and may be removed at any time. The feature seems useful, especially for large websites where it's likely that a developer may ...
5
votes
1answer
336 views

What was the real reason for dropping reflected-xss directive from CSP?

There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past. X-XSS Protection: 1; mode=block ...
5
votes
1answer
287 views

Why does Chrome claim that this stylesheet violates the Content Security Policy?

I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server. I wanted to write my Content Security Policy in a way to permit all local ...
2
votes
2answers
567 views

Does Chrome respect the X-DNS-Prefetch-Control header?

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?: <link rel="dns-prefetch" href="http://www.spreadfirefox.com/"> I know Firefox and Chromium ...
2
votes
1answer
59 views

Off the shelf JavaScript based CSP alternative - is it safe?

Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest ...
8
votes
1answer
528 views

Content Security Policy Style Hash

I have an img tag on a page with an line style that looks like this: style="height:50px;width:180px;display:block;" I can't move it to an external stylesheet because the img tag is generated by a ...
3
votes
1answer
246 views

Why does Adobe recommend not setting CSP headers for its web fonts?

In this help site, Adobe recommends not setting CSP for web fonts saying: The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain. and ...
0
votes
1answer
73 views

XSS and Content Security Policy, and existing CSS

I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
-1
votes
2answers
66 views

How does a Content Security Policy help with preventing XSS and other injection vulnerabilities? [closed]

I was reading up on CSP's and I did some testing on a site which had one implemented, I found an xss vulnerability even though it was using a CSP.
1
vote
1answer
154 views

In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision?

So in a CSP like the below: content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com Should the url part be quoted like this (example from mozilla ...
1
vote
1answer
178 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
1
vote
2answers
90 views

How safe is it to allow JS CDNs in a HTTP content security policy?

I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
7
votes
1answer
2k views

What's the difference between frame-ancestors and child-src?

Both options seem to control who can embed the content in an <iframe> tag, just like X-Frame-Options does. Chrome and Safari are deprecating this header (partially, allow-from for instance), so ...
0
votes
1answer
195 views

Content Security Policy (CSP) alternatives

Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline ...
0
votes
0answers
109 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
24
votes
4answers
8k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
2
votes
0answers
39 views

CSP for iFrame without any src attribute

I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
0
votes
0answers
28 views

Accessing a permitted file from local file system securely

I am working on project which has more focus on user data security. Public key cryptography is being used in this and private key is getting stored to user device locally (computer local file system). ...
1
vote
1answer
90 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
1answer
105 views

Zero Day Policies implementation

I'm new here, and sorry if my english is a little bit broken it's not my main language. I'm trying to put together a document/ppt for my startup with a Zero Day policy structure. But I'm not finding ...
12
votes
3answers
12k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
3
votes
3answers
282 views

CSP reporting to another origin

I was implementing a CSP policy and set up the reporting endpoint as another domain, a completely separate origin. Everything seemed to work fine, but talking to a few friends they seemed surprised ...
0
votes
1answer
218 views

HSTS preload and requisites on domain - subdomains must be added too?

I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/ However the ...
2
votes
1answer
508 views

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

Ever since CSP 3 introduced strict-dynamic, Google has recommended its usage. Indeed, the idea of maintaining one "root" script, which in turn loads all other necessary scripts, sets up event handlers,...
0
votes
1answer
125 views

Where can I configure certificate rules on Windows 10?

This excellent SSO answer recommends to use certificate rules on Windows’ executables, as explained here by Microsoft. The latter says that the “location” of this setting is: Computer Configuration\...
2
votes
1answer
162 views

Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?

Here is an example of the CSP of accounts.google.com: content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
5
votes
3answers
327 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
2
votes
1answer
494 views

Content Security Policy: postMessage into foreign iframe

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
1
vote
0answers
252 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
2
votes
1answer
1k views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
1
vote
2answers
3k views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
1
vote
1answer
90 views

Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP?

Some websites use Content-Security-Policy nonces in order to include inline styling and script in their webpages. Is the CSP nonce feature designed to be used for production use, or is it simply ...