Questions tagged [content-security-policy]

Content Security Policy is a mechanism for mitigating attacks against web applications.

1
vote
1answer
90 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
539 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
1answer
197 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
2
votes
0answers
41 views

Why does Adobe recommend not setting CSP headers for its web fonts?

In this help site, Adobe recommends not setting CSP for web fonts saying: The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain. and ...
2
votes
0answers
251 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
2
votes
0answers
64 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
1
vote
0answers
116 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
1
vote
0answers
237 views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
1
vote
0answers
730 views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
1
vote
0answers
568 views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...
1
vote
0answers
49 views

Informational security model models and life-cycle

NSM model from sans.org is vendor neutral,that's good, but I need more detail and complexity model. Don't want to invent a bicycle and looking for complete solution in this field.Looking not for blog ...
1
vote
0answers
820 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
-2
votes
0answers
62 views

How to secure apis so that it can be used by my app and web only

I am creating a platform which is based on REST APIs. My platform has apps and web both. I don't want to make my APIs public and want that my APIs can be used by my own clients (app and web) only. I ...