Skip to main content

Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

36 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
1 answer
739 views

Google CSP Evaluator and style-src 'unsafe-inline'

Google provides a CSP evaluator to validate if a given content-security policy is well set up (github, validator). However, if one uses 'unsafe-inline' in the style-src directive this is reported as '...
nocab's user avatar
  • 51
3 votes
0 answers
481 views

Understanding CSP: report shows blocked <script> that shouldn't have been blocked

I'm having trouble making sense of some reported CSP violations that don't seem to actually be violations according to the CSP standard. I have not managed to reproduce the violations in my own ...
Conor Mancone's user avatar
3 votes
0 answers
237 views

CSP for iFrame without any src attribute

I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
theIceBandit's user avatar
3 votes
2 answers
1k views

Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?

My understanding is that: SVGs offer far greater functionality if they are directly embedded in a site's HTML code via the <svg> tag than if they are linked to via the <img> tag For ...
gaazkam's user avatar
  • 6,027
2 votes
0 answers
177 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
2 votes
0 answers
1k views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
Maikkeyy's user avatar
  • 217
2 votes
0 answers
2k views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
vegedezozu's user avatar
2 votes
0 answers
900 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
jaya sharma's user avatar
2 votes
0 answers
132 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
Nabyla elmohrir's user avatar
1 vote
0 answers
53 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
1 vote
0 answers
74 views

Content security policy for script-src directive

I have a web app that is built using Vite for the react front-end part and uses .net API backend. The backend also configures a static file service for the prebuild frontend files but otherwise ...
Robert Koritnik's user avatar
1 vote
1 answer
566 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
1 vote
1 answer
135 views

Security headers: Are they needed on subsequent requests (eg. Scripts, Images) after they have been sent on the main HTML request?

I had a discussion with PenTesters at my company today, who have said that security headers, like for example Content-Security-Policy, Strict-Transport-Security, Referrer-Policy and Permissions-Policy,...
Michael Salivon's user avatar
1 vote
0 answers
276 views

do I need CSP: frame-ancestors on a redirect page?

We are implementing clickjacking protection on our website as follows: By default every page on our site has frame-ancestors self We have a list of pages that are specifically designed to be ...
Uriel Zylbermann's user avatar
1 vote
0 answers
188 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
almisson's user avatar
1 vote
0 answers
522 views

chrome-extension as source of CSP policy violation

Here is an extract from a CSP report [csp-report] => Array ( [blocked-uri] => chrome-extension [column-number] => 27329 [document-uri] => https://www.mysite.com/...
Amblymoron's user avatar
1 vote
0 answers
365 views

Safely render HTML template with inline CSS from trusted domain (it forces the use of "style-src: unsafe-inline" in CSP)

I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
ptf's user avatar
  • 111
1 vote
0 answers
142 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
Alex V's user avatar
  • 200
1 vote
1 answer
634 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
David Scholefield's user avatar
1 vote
0 answers
482 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
Nani's user avatar
  • 11
1 vote
0 answers
2k views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...
Shiv Sahni's user avatar
1 vote
0 answers
106 views

Informational security model models and life-cycle

NSM model from sans.org is vendor neutral,that's good, but I need more detail and complexity model. Don't want to invent a bicycle and looking for complete solution in this field.Looking not for blog ...
Paul's user avatar
  • 11
1 vote
0 answers
2k views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
Caothu's user avatar
  • 11
0 votes
0 answers
56 views

Content security policy (CSP) reports that seem unrelated to the web app

I've setup Content Security Policy (CSP) on a web app. For the time being it's set to report only so that I can assess it first in production and then turn it on if things get clear. But so far they'...
Robert Koritnik's user avatar
0 votes
1 answer
61 views

Why is a domain specified in a CSP default-src being reported as a script-src-elem violation?

I have a Content-Security-Policy-Report-Only: header of: default-src 'report-sample' 'self' *.googleapis.com; object-src 'none'; report-uri https://example.com/csp_logger; but violations are being ...
jaygooby's user avatar
  • 101
0 votes
0 answers
68 views

CSP blocking whitelist domains in web application

My project has a csp policy Content-Security-Policy script-src 'self' 'unsafe-inline' https://*.mycompanycdn.com; report-uri mycompany.in/reportcsp In the violation logs I found with blocked-uri ...
Ivanov's user avatar
  • 21
0 votes
0 answers
82 views

Is it possible to track cross origin redirection?

I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
Hackermon's user avatar
0 votes
1 answer
93 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9
0 votes
0 answers
122 views

unsafe-hashes an alternatives

I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine. <script th:inline="javascript"> /*<![CDATA[*/ var ...
Shaunyl's user avatar
  • 101
0 votes
0 answers
525 views

The most safe combination for Content Security Policy

I need high security for my app, so I have to add security headers for my views. However, I'm not entirely sure I understood the CSP header correctly (specifically its parameters). Is my combination ...
Szyszka947's user avatar
0 votes
0 answers
140 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
Moses Lara's user avatar
0 votes
1 answer
382 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...
Rebooting's user avatar
  • 113
0 votes
0 answers
777 views

CSP: any way to prevent inline scripts dynamically created by a trusted external script?

Let's say I have a simple web application which uses a single JavaScript (JS) file, loaded from its own domain, and has implemented the restrictive Content Security Policy (CSP) of default-src 'self'. ...
Aayla Secura's user avatar
0 votes
0 answers
390 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
Alex's user avatar
  • 1
0 votes
1 answer
289 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
Vrashabh Irde's user avatar
-1 votes
2 answers
218 views

HSTS Policy Not Appear in Burp Intercept Response

We have added HSTS policy at Akamai level (domain). When we Intercept the request using burp we dont see HSTS policy is getting added in response, in case we hit site with http. But with https we able ...
Vivek Dhiman's user avatar