Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [content-security-policy]

Content Security Policy is a mechanism for mitigating attacks against web applications.

0
votes
1answer
214 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
1answer
188 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
2
votes
0answers
230 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
2
votes
0answers
63 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
1
vote
0answers
71 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
1
vote
0answers
144 views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
1
vote
0answers
523 views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
1
vote
0answers
522 views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...
1
vote
0answers
49 views

Informational security model models and life-cycle

NSM model from sans.org is vendor neutral,that's good, but I need more detail and complexity model. Don't want to invent a bicycle and looking for complete solution in this field.Looking not for blog ...
1
vote
0answers
793 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
0
votes
0answers
37 views

WebWorker Hash-Source CSP importScripts

I have been trying to move my site to hash-source CSP instead of host-source CSP to verify integrity of files distributed by a CDN. I have a WebWorker running in the background, which imports a few ...
0
votes
0answers
202 views

Single Page Application and CSRF Token generated every time

I need to use a Single Page Application (React, Ember, Angular, I don't care) with Rails CSRF protection mechanism. I'm wondering if I need to create a token evey time in the ApplicationController ...