The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
24
votes
4answers
8k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
24
votes
2answers
8k views

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
22
votes
2answers
7k views

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%...
17
votes
1answer
705 views

Is it safe to send Content-Security-Policy header for text/html content-type only?

Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets -...
16
votes
2answers
4k views

Why is CSP needed to protect against img-src leak?

GitHub explains the problem with img-src in "GitHub's post-CSP journey": A tag with an unclosed quote will capture all output up to the next matching quote. This could include security sensitive ...
12
votes
3answers
11k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
11
votes
3answers
542 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on. I ...
11
votes
2answers
4k views

Iframe inheriting parent's Content Security Policy

I have a parent page that has a Content Security Policy on it. The main purpose of CSP is not to prevent XSS, but to prevent network access. This page has to run some user generated/submitted HTML/CSS/...
10
votes
4answers
3k views

CSP allowing all Google domains?

I'm trying to develop a CSP for the site https://www.lidl-tour.ro. Right now there is a policy than runs in report-only-mode, so nothing is blocked at the moment. The site contacts googleads.g....
10
votes
3answers
1k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
9
votes
2answers
1k views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution to ...
8
votes
3answers
921 views

Is Content Security Policy only enforced during initial rendering?

Is CSP enforced only during initial rendering, meaning there is no continuous coverage after your document loads? Here is an example of what I'm talking about: Let's say your page, example.com, has ...
7
votes
3answers
353 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
6
votes
2answers
532 views

Is there a HSTS equivalent for specifying TLS version?

HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting. Is there any HSTS alternative or extension that ...
6
votes
1answer
2k views

What's the difference between frame-ancestors and child-src?

Both options seem to control who can embed the content in an <iframe> tag, just like X-Frame-Options does. Chrome and Safari are deprecating this header (partially, allow-from for instance), so ...
5
votes
3answers
1k views

What are the limitations of Content Security Policy?

I'm wondering what this new technique will not protect us against. As I see it, since inline scripts are disabled (and I assume that includes javascript: links) then it solves the issue of covert ...
5
votes
1answer
1k views

How does a trusted maps.googleapis.com in CSP enable an XSS vulnerability? (JSONP)

I am testing out the tool CSP Evaluator, and have a question regarding the following content-security-policy: default-src https://maps.googleapis.com The tool consider this as a high risk: maps....
5
votes
1answer
1k views

Content-Security-Policy: Getting weird reports with frame-ancestors 'self'

Right now, I maintain the Content-Security-Policy for https://www.lidl.de, which is: Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/...
5
votes
3answers
284 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
5
votes
1answer
309 views

Can BeEF hooking be stopped with Content Security Policies

I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
5
votes
1answer
808 views

XSS vulnerability with strict CSP

The article I’m harvesting credit card numbers and passwords from your site. Here’s how. describes the phases of a theoretical attack where an attacker can bypass a strict CSP and exfiltrate sensitive ...
5
votes
1answer
2k views

Content-Security-Policy & Facebook login

This question seems to be related to https://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
4
votes
3answers
5k views

Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?

In my Content Security Policy I have included require-sri-for script. However, in the Chrome console I get a notice (not an error, just info): The Content-Security-Policy directive 'require-sri-for'...
4
votes
1answer
2k views

What's the alternative of content security policy (CSP) header in Internet Explorer IE?

As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer. So, if we want to support CSP in our ...
4
votes
2answers
872 views

Securing Micro Services Architecture internally

I am implementing a solution with set of Micro Services (Spring Rest Services) with Rabbit MQ as the message broker. The Edge server is Authenticated using OAuth based Identity server. Internal ...
4
votes
2answers
322 views

XSS and Content Security Policy

Can XSS be prevented 100% by setting the content security policy as default-src 'self'? Is there any way XSS can happen in that case? One possibility I can think of is injecting user input into one of ...
4
votes
1answer
173 views

Poor result on securityheaders.io for google.com

I have just tested google on securityheaders.io and the result was D. Google is actually not setting following security headers Content-Security-Policy X-Content-Type-Options Referrer-Policy I ...
4
votes
3answers
2k views

Is CSP enough to prevent XSS attacks [duplicate]

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? I'm working on a Backbone app, and am wondering if I still need to be escape user ...
3
votes
2answers
689 views

CSP: upgrade-insecure-requests - what happens with https-incompatible ressources?

I have two questions regarding the CSP directive upgrade-insecure-requests which I couldn't answer myself by reading the specification. What happens to ressources which can't be upgraded to https (e....
3
votes
2answers
398 views

Does allowing unsafe-inline script defeat the purpose of CSP?

I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website). Content-Security-Policy: "default-src '...
3
votes
2answers
461 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
3
votes
2answers
483 views

What does the CSP require-sri-for directive protect against?

According to Mozilla: The HTTP Content-Security-Policy require-sri-for directive instructs the client to require the use of Subresource Integrity for scripts or styles on the page. I fail to see ...
3
votes
1answer
687 views

How do I control multiply-nested embedding of my iframe?

Domain example1.com embeds my iframe. Domain example2.com embeds an iframe served from example1.com. I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
3
votes
1answer
69 views

Is it possible to specify a content security policy in browsers?

Normally, content security policies are sent in the response headers by the server to the client browser telling it what is and is not acceptable to load on the site. Is there a way to do this in ...
3
votes
3answers
206 views

CSP reporting to another origin

I was implementing a CSP policy and set up the reporting endpoint as another domain, a completely separate origin. Everything seemed to work fine, but talking to a few friends they seemed surprised ...
3
votes
2answers
119 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit in?...
3
votes
1answer
1k views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a javascript-...
3
votes
1answer
618 views

CSP base-uri directive on “View page source” on

I am in the process of implementing a CSP header for a webapp, with the goal of reducing possible XSS attacks. See CSP for an overview of CSP. I provided the base-uri directive as 'self' and this ...
2
votes
2answers
1k views

Why are inline scripts and styles considered not secure under content security policy?

Inline scripts and styles are just a kind of language (CSS/Javascript) embedded in another langauge (HTML). Why are them not allowed by default under content security policy?
2
votes
1answer
2k views

How to specifically whitelist JS libraries which need unsafe-eval

Is it possible to specify source list values based on the script src. The RFC mentions it, but I'm not sure about its usage. For example: Content-Security-Policy:default-src *; script-src 'unsafe-...
2
votes
2answers
270 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
2
votes
1answer
48 views

is there a low-overhead way to log every new file created on a Linux host?

I know about inotify but am concerned it would use too many resources. Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
2
votes
1answer
74 views

Should I allow http script sources in my CSP, or enforce https only?

I'm currently trying to implement a third-party widget into my website. That widget attempts to load some scripts over http, which is currently disallowed by my content security policy. I'm concerned ...
2
votes
1answer
499 views

Does an Embedded Content Security Policy (CSP) Enforcement ruin a “regular” CSP?

I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP). This document defines a mechanism by which a web page can embed a nested browsing context if ...
2
votes
1answer
238 views

Content Security Policy: postMessage into foreign iframe

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
2
votes
1answer
393 views

Is there any point in using 'strict-dynamic' in an AngularJS 1.x application?

I do not see the point in using CSP 3's new strict-dynamic in the case of an AngularJS 1.x application. As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a ...
2
votes
1answer
75 views

Why does Adobe recommend not setting CSP headers for its web fonts?

In this help site, Adobe recommends not setting CSP for web fonts saying: The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain. and ...
2
votes
1answer
74 views

CSP to report HTTP resources?

I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of ...
2
votes
1answer
411 views

Content-Security-Policy suspicious entries in the log

I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src for suspicious URLs: https://...
2
votes
1answer
527 views

SRI for CSP - how do I get the hash for inline code?

I have been messing about with website design for years, but I am no expert - more of a hardware junkie. CSP is fascinating for me now that I am starting to branch out into web development. I was ...