Questions tagged [content-security-policy]
This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].
217 questions
0
votes
1
answer
40
views
How to find out if CSP report is XSS vulnerability or malicious browser extension?
I have recently added CSP headers to a rather complex web application, being -report-only at first.
I got some noise from browser extensions in the report, but two incidents caught my eye especially:
...
- 417
0
votes
2
answers
97
views
Is this CSP issue a false positive?
I just ran into a weird situation with Burp Suite Professional. They unfortunately discontinued their forum, so I'm asking here.
It starts with the following Content-Security Policy (CSP):
Content-...
- 110
1
vote
0
answers
136
views
HTTP headers needed for cross-origin communication with postMessage()/onmessage
I'm experimenting with Direct Sockets TCPServerSocket, TCPSocket, and UDPSocket in an Isolated Web App (IWA) on Chromium browser.
The maintainers are trying to uphold the claim that a window can ...
- 149
0
votes
1
answer
107
views
Is Content-Security-Policy advised when allowing external scripts through a plugin?
I'm currently on the development team for a Shopware webshop with approximately 650.000 users. The client requested the installation of the following two plugins: CMS HTML Code Block and Custom ...
- 3,540
4
votes
1
answer
861
views
What is the attack vector in allowing to frame non-HTML content?
This question is specific to Clickjacking attacks and Content Security Policy.
When the server sends a static resource, such as .gif, .woff, .js file, which is not an .html, what is the security ...
- 498
0
votes
1
answer
760
views
Angular's recommended CSP doesn't make sense to me
I am trying to implement a CSP policy for our Angular 18 application based on Angular's CSP recommendation and I have found that their recommendation does not make sense to me.
Specifically their use ...
- 105
0
votes
1
answer
377
views
How to securely load user genereated Javascript code from IFrame into my website?
Before I start, I have found a few related references to this question, but they are not answered previously or are about a slightly different scenario to mine.
I have the following need. I need a way ...
- 115
3
votes
1
answer
435
views
CSP: no sandbox, or sandbox with Access-Control-Allow-Origin: "null"?
I host two public sites with WordPress, using different themes (but official ones, named "twenty-something") on an Apache server (Debian Bookworm), and I'm updating my CSP.
If I enable ...
- 133
3
votes
1
answer
2k
views
Is it Safe to Update Content Security Policy to Allow Blob URLs for iframes?
I am currently implementing a feature that allows users to upload documents (mainly pdfs) and view them in the browser without storing them on a server. The application generates a blob URL from the ...
1
vote
0
answers
119
views
CSP Violation repot has a [blockedURL] that is in the [originalPolicy]
I keep getting Content Security Policy reports saying that https://googleads.g.doubleclick.net:443/pagead/viewthroughconversion/[redacted]/?random=... has been blocked by the img-src [...
- 111
1
vote
1
answer
417
views
CSP, inline SVG, and XML attributes
I recently added some inline SVG images to my website, and the browsers complained about the style attributes within the SVG code not being covered by my strict CSP (style-src: self). Instead of ...
- 135
1
vote
1
answer
188
views
Basic monitoring of web applications (http headers, HSTS)
I would like to set up som basic monitoring of outgoing traffic for a number of web applications and api´s running in AWS. E.g.
Ensure specific http headers are in place (Content-Security-Policy and ...
- 141
1
vote
1
answer
632
views
Real life example of CSP containing report-uri and report-to
I need to setup CSP header containing report-uri and report-to simultaneously because many site clients using old Firefox and Chrome versions. How to setup both of these attributes in CSP?
UPD. Also i ...
4
votes
1
answer
433
views
Can URL maskers bypass browser XSS blockers?
I know that basically every modern browser version has a cross-site-scripting blocker for XSSed URLs, as in the type of filter that actually stops a user from visiting the URL, warning them of the ...
- 4,815
6
votes
1
answer
975
views
If I'm using HSTS, can I skip the scheme from my CSP directives?
For various reasons, I need to shrink my CSP header a bit without degrading its effectiveness. I'm able to save some bytes by wildcarding some subdomains, but I'm also tempted to strip out all ...
- 163