Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Filter by
Sorted by
Tagged with
0 votes
1 answer
37 views

Does the connect-src directive block the ability to make a request, or it blocks access to the response?

Does the connect-src directive block the ability to make a request, or it blocks access to the response?
Nikita Khodakovsky's user avatar
1 vote
0 answers
47 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
0 votes
1 answer
78 views

Bypassing CSP and implementing XSS attack

I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet: .use( helmet.contentSecurityPolicy({ directives: { ...
EPiez's user avatar
  • 13
0 votes
0 answers
46 views

Content security policy (CSP) reports that seem unrelated to the web app

I've setup Content Security Policy (CSP) on a web app. For the time being it's set to report only so that I can assess it first in production and then turn it on if things get clear. But so far they'...
Robert Koritnik's user avatar
0 votes
1 answer
53 views

Why is a domain specified in a CSP default-src being reported as a script-src-elem violation?

I have a Content-Security-Policy-Report-Only: header of: default-src 'report-sample' 'self' *.googleapis.com; object-src 'none'; report-uri https://example.com/csp_logger; but violations are being ...
jaygooby's user avatar
  • 101
1 vote
1 answer
75 views

CSP : Different hash for the same external library (Firefox vs Chrome)

During my implementation of a proof of concept for a CSP, I noticed that the hash value for the external library (jquery in this example) isn't the same between Firefox and Chrome and I can't figure ...
Marc's user avatar
  • 13
1 vote
0 answers
60 views

Content security policy for script-src directive

I have a web app that is built using Vite for the react front-end part and uses .net API backend. The backend also configures a static file service for the prebuild frontend files but otherwise ...
Robert Koritnik's user avatar
0 votes
2 answers
118 views

Does CSP protect against XSS in url?

If I have a web app that is vulnerable to XSS in the url (reflected XSS), does CSP protect against this type of XSS? Ex: when I run www.example.com/<script>alert(1);</script> in the ...
anonymous's user avatar
0 votes
0 answers
61 views

CSP blocking whitelist domains in web application

My project has a csp policy Content-Security-Policy script-src 'self' 'unsafe-inline' https://*.mycompanycdn.com; report-uri mycompany.in/reportcsp In the violation logs I found with blocked-uri ...
Ivanov's user avatar
  • 21
0 votes
0 answers
72 views

Is it possible to track cross origin redirection?

I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
Hackermon's user avatar
7 votes
3 answers
2k views

Is storing authentication tokens in local storage with a strong CSP safe?

Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
Mad Scientist's user avatar
2 votes
0 answers
164 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
3 votes
2 answers
223 views

Benefit of permissive Content-Security-Policy

I am new to the concept of Content-Security-Policy (CSP) so please forgive my ignorance. The site https://securityheaders.com parses headers and provides a score. For example unibet.com is awarded a ...
Andreas F's user avatar
  • 131
0 votes
1 answer
90 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9
0 votes
0 answers
116 views

unsafe-hashes an alternatives

I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine. <script th:inline="javascript"> /*<![CDATA[*/ var ...
Shaunyl's user avatar
  • 101
1 vote
1 answer
453 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
0 votes
1 answer
105 views

Implications of SHA256 implementation producing false / unexpected hashes

I found that one of our programs uses an sha256 implementation, that produces different hashes for same inputs, compared to standard libraries (in this case compared to node:crypto and Web Crypto API. ...
Jankapunkt's user avatar
4 votes
1 answer
5k views

Is it safe to use font-src with data: in a Content Security Policy?

I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with abcdefg in this example: Refused to load the font 'data:font/...
x3nr0s's user avatar
  • 143
1 vote
1 answer
735 views

CSP and X-Frame options for site that is designed to be embedded

We host a small (.Net) website for our customers; it's designed to be embedded within both our own hosted pages, and potentially within the customers own web applications (both internal and external). ...
KenD's user avatar
  • 113
0 votes
0 answers
502 views

The most safe combination for Content Security Policy

I need high security for my app, so I have to add security headers for my views. However, I'm not entirely sure I understood the CSP header correctly (specifically its parameters). Is my combination ...
Szyszka947's user avatar
0 votes
1 answer
111 views

How secure is using https://*.domain.com as a value in a Content Security Policy?

Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet. The CSP for that website is Content-...
Sky's user avatar
  • 1
2 votes
1 answer
138 views

Should I call a vulnerability XSS even though it is blocked by the CSP?

Let's say the Content Security Policy looks like this: Content-Security-Policy: default-src 'self'; It's also not possible to upload JS files on the same origin. Now there's an exploit to write ...
Jonas's user avatar
  • 23
1 vote
1 answer
131 views

Security headers: Are they needed on subsequent requests (eg. Scripts, Images) after they have been sent on the main HTML request?

I had a discussion with PenTesters at my company today, who have said that security headers, like for example Content-Security-Policy, Strict-Transport-Security, Referrer-Policy and Permissions-Policy,...
Michael Salivon's user avatar
1 vote
0 answers
260 views

do I need CSP: frame-ancestors on a redirect page?

We are implementing clickjacking protection on our website as follows: By default every page on our site has frame-ancestors self We have a list of pages that are specifically designed to be ...
Uriel Zylbermann's user avatar
-1 votes
2 answers
210 views

HSTS Policy Not Appear in Burp Intercept Response

We have added HSTS policy at Akamai level (domain). When we Intercept the request using burp we dont see HSTS policy is getting added in response, in case we hit site with http. But with https we able ...
Vivek Dhiman's user avatar
0 votes
2 answers
960 views

nonce generation based on php session id

On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to 'self' would ...
theking2's user avatar
  • 146
3 votes
2 answers
1k views

Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?

My understanding is that: SVGs offer far greater functionality if they are directly embedded in a site's HTML code via the <svg> tag than if they are linked to via the <img> tag For ...
gaazkam's user avatar
  • 6,017
1 vote
1 answer
1k views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
John's user avatar
  • 11
0 votes
1 answer
635 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
Prime's user avatar
  • 514
2 votes
1 answer
315 views

Report-URI CSP Directive

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used. Content-Security-Policy: report-uri https://www.example.com Does the above ...
Joel Deleep's user avatar
1 vote
1 answer
3k views

CORS request is not sending Authorization: Bearer <value> header

When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header. ...
mrrrvssmx's user avatar
2 votes
1 answer
184 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
Joel Deleep's user avatar
1 vote
1 answer
511 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
Qi luo's user avatar
  • 13
0 votes
1 answer
181 views

Is this CSP implementation is secure?

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...
Cloud Learner's user avatar
5 votes
1 answer
729 views

Is CSP meant to be used with HTTPS (TLS) only?

If a site uses HTTP and not HTTPS, is it useful to include a Content Security Policy? Can an adversary not just remove it?
savx2's user avatar
  • 153
0 votes
1 answer
973 views

Content Security Policy (CSP) - why does a JS file have multiple hashes?

I'm looking at my browser's console and I see the following error: These all pertain to the same JS file. I'm trying to figure out what's the quickest way to make these error go away. I'm guessing I ...
SecurityNewbie's user avatar
1 vote
1 answer
246 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
Chris Riddle's user avatar
5 votes
1 answer
721 views

Google CSP Evaluator and style-src 'unsafe-inline'

Google provides a CSP evaluator to validate if a given content-security policy is well set up (github, validator). However, if one uses 'unsafe-inline' in the style-src directive this is reported as '...
nocab's user avatar
  • 51
0 votes
0 answers
136 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
Moses Lara's user avatar
1 vote
1 answer
582 views

HTML Object Tag

In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
new-to-networking's user avatar
0 votes
1 answer
488 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
user259894's user avatar
2 votes
2 answers
398 views

Can a Content Security Policy (CSP) enable *new* unsafe behavior?

Does the design and implementation of the content security policy standard allow for the introduction of new unsafe behavior that wasn't there prior to having any CSP at all? For example if my ...
MT.'s user avatar
  • 123
0 votes
3 answers
271 views

On what types of web content is a Content-Security-Policy useful?

The W3C spec for Content-Security-Policy or Mozilla CSP docs would be the definitive source for this answer, but it does not seem covered, so I'm asking here for answers based on people's experience. ...
Mike Ounsworth's user avatar
6 votes
2 answers
5k views

Content Security Policy https: and data: meaning

I am having trouble finding information on the implications of using https: and data: as a source for the directives in a CSP. Example: img-src 'self' https: data:; Could someone some context around ...
Chris K's user avatar
  • 177
5 votes
3 answers
5k views

When is content security policy (CSP) not appropriate?

We've recently conducted a security review of our identity server website and one of the finding was about missing CSP header. We do have implementation of request filter to add CSP on a controller ...
MichaelChan's user avatar
2 votes
1 answer
2k views

Example of script-src-attr that is not already handled by script-src-elem

What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don't want ...
Amblymoron's user avatar
0 votes
1 answer
818 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
user2942358's user avatar
1 vote
2 answers
2k views

Noob question on security of localhost

This may already have been answered, but I'm having difficulty understanding the technical jargon of various posts. I have to give a Callback URL to receive some sort of validation, to use an API. ...
AUser240's user avatar
1 vote
0 answers
185 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
almisson's user avatar
0 votes
2 answers
216 views

Content Security Policy [closed]

I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak. I also see that the implementation of the CSP is ...
Ion Stirba's user avatar

1
2 3 4 5