Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
1
vote
0answers
17 views

CSP for iFrame without any src attribute

I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
0
votes
0answers
23 views

Accessing a permitted file from local file system securely

I am working on project which has more focus on user data security. Public key cryptography is being used in this and private key is getting stored to user device locally (computer local file system). ...
1
vote
1answer
61 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
24
votes
4answers
7k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
2
votes
1answer
570 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
82 views

Zero Day Policies implementation

I'm new here, and sorry if my english is a little bit broken it's not my main language. I'm trying to put together a document/ppt for my startup with a Zero Day policy structure. But I'm not finding ...
2
votes
1answer
69 views

Why does Adobe recommend not setting CSP headers for its web fonts?

In this help site, Adobe recommends not setting CSP for web fonts saying: The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain. and ...
0
votes
1answer
826 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
12
votes
3answers
11k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
3
votes
3answers
180 views

CSP reporting to another origin

I was implementing a CSP policy and set up the reporting endpoint as another domain, a completely separate origin. Everything seemed to work fine, but talking to a few friends they seemed surprised ...
0
votes
1answer
72 views

HSTS preload and requisites on domain - subdomains must be added too?

I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/ However the ...
1
vote
1answer
89 views

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

Ever since CSP 3 introduced strict-dynamic, Google has recommended its usage. Indeed, the idea of maintaining one "root" script, which in turn loads all other necessary scripts, sets up event handlers,...
0
votes
1answer
45 views

Where can I configure certificate rules on Windows 10?

This excellent SSO answer recommends to use certificate rules on Windows’ executables, as explained here by Microsoft. The latter says that the “location” of this setting is: Computer Configuration\...
1
vote
1answer
107 views

Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?

Here is an example of the CSP of accounts.google.com: content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
5
votes
3answers
275 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
2
votes
1answer
188 views

Content Security Policy: postMessage into foreign iframe

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
1
vote
0answers
163 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
1
vote
1answer
411 views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
0
votes
2answers
1k views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
1
vote
1answer
44 views

Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP?

Some websites use Content-Security-Policy nonces in order to include inline styling and script in their webpages. Is the CSP nonce feature designed to be used for production use, or is it simply ...
2
votes
1answer
2k views

How to specifically whitelist JS libraries which need unsafe-eval

Is it possible to specify source list values based on the script src. The RFC mentions it, but I'm not sure about its usage. For example: Content-Security-Policy:default-src *; script-src 'unsafe-...
10
votes
3answers
1k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
0
votes
1answer
111 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
2
votes
1answer
46 views

is there a low-overhead way to log every new file created on a Linux host?

I know about inotify but am concerned it would use too many resources. Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
3
votes
2answers
305 views

Does allowing unsafe-inline script defeat the purpose of CSP?

I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website). Content-Security-Policy: "default-src '...
2
votes
2answers
245 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
2
votes
1answer
393 views

Content-Security-Policy suspicious entries in the log

I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src for suspicious URLs: https://...
17
votes
1answer
661 views

Is it safe to send Content-Security-Policy header for text/html content-type only?

Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets -...
7
votes
3answers
337 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
2
votes
0answers
215 views

What are the dangers of “style-src: 'unsafe-inline'”? [duplicate]

This is a common sight in content security policies: style-src 'unsafe-inline' I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
1
vote
0answers
274 views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
2
votes
1answer
70 views

CSP to report HTTP resources?

I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of ...
3
votes
1answer
588 views

How do I control multiply-nested embedding of my iframe?

Domain example1.com embeds my iframe. Domain example2.com embeds an iframe served from example1.com. I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
4
votes
1answer
2k views

What's the alternative of content security policy (CSP) header in Internet Explorer IE?

As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer. So, if we want to support CSP in our ...
1
vote
1answer
91 views

Do we need to add CSP to all web pages in a web application?

We have a multi-page web application. I understand that ideally CSP should be set for text/html responses only. Is it enough to add content security policy (CSP) header to the login page or should I ...
5
votes
1answer
281 views

Can BeEF hooking be stopped with Content Security Policies

I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
1
vote
2answers
519 views

What attacks does Content Security Policy base-uri protect against?

I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
2
votes
0answers
870 views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
0
votes
2answers
110 views

Best way to encrypt user data stored in xml?

First of all I am not very familiar with the world of encryption so please be nice. I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
9
votes
2answers
1k views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution to ...
2
votes
0answers
269 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
8
votes
3answers
871 views

Is Content Security Policy only enforced during initial rendering?

Is CSP enforced only during initial rendering, meaning there is no continuous coverage after your document loads? Here is an example of what I'm talking about: Let's say your page, example.com, has ...
1
vote
0answers
37 views

How to protect the control environment of my web application? [closed]

I am developing a web application and want to do its setup and control using my personal notebook. However, the following topics concern me: 1) Enter the platform (includes the login in the control ...
24
votes
2answers
7k views

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
10
votes
4answers
3k views

CSP allowing all Google domains?

I'm trying to develop a CSP for the site https://www.lidl-tour.ro. Right now there is a policy than runs in report-only-mode, so nothing is blocked at the moment. The site contacts googleads.g....
2
votes
1answer
493 views

SRI for CSP - how do I get the hash for inline code?

I have been messing about with website design for years, but I am no expert - more of a hardware junkie. CSP is fascinating for me now that I am starting to branch out into web development. I was ...
0
votes
1answer
411 views

CSP header default-src: data:

I am testing CSP header implementation. The implemented header value is: Content-Security-Policy: default-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-...
1
vote
1answer
431 views

Using Content Security Policy in AMP-HTML pages?

I have a site built with AMP. I tried to use Content-Security-Policy: script-src 'self', but all styles and designs didn't show properly since they are loaded from cdn.ampproject.org. Google, in their ...
4
votes
3answers
4k views

Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?

In my Content Security Policy I have included require-sri-for script. However, in the Chrome console I get a notice (not an error, just info): The Content-Security-Policy directive 'require-sri-for'...
2
votes
3answers
600 views

Content Security Policy against clickjacking fails with static PoC

I have a doubt regarding the use of the Content Security Policy (CSP) as protection mechanism against clickjacking. I have created an online Proof of Concept (PoC) on a web page where I put a button ...