IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [content-security-policy]

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Content Security Policy is a HTTP header, designed to tell the browser what sources a website is allowed to request data from.

The following is an example of a Content Security Policy header:

script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https:;
object-src 'none';
base-uri 'none';
report-uri https://csp.example.com;

The header consists of several directives, such as default-src, script-src, object-src or style-src. Each of these directives defines where the corresponding content may be loaded from.

For example, style-src 'self' means that stylesheets may only be loaded from the same origin as the main document. img-src https: means that images can be included from anywhere, as long as the https schema is being used.

The Mozilla docs contain an in-depth article on the Content Security Policy header, its versions and its usage.

186 questions
48
votes
2 answers

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%20encod…E%3C%2Fg%...%3C%2Fsvg%3E' because it violates…
Martin Verner
  • 585
  • 1
  • 4
  • 8
33
votes
2 answers

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
Ali Ahmad
  • 4,784
  • 8
  • 35
  • 61
24
votes
4 answers

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both infrastructure and e.g. DevOps. So we are using…
ooouuiii
  • 389
  • 2
  • 6
19
votes
1 answer

Is it safe to send Content-Security-Policy header for text/html content-type only?

Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets - images, JS and CSS files?
AlexD
  • 241
  • 1
  • 8
19
votes
5 answers

CSP allowing all Google domains?

I'm trying to develop a CSP for the site https://www.lidl-tour.ro. Right now there is a policy than runs in report-only-mode, so nothing is blocked at the moment. The site contacts googleads.g.doubleclick.net and stats.g.doubleclick.net. So I have…
HorstKevin
  • 1,328
  • 2
  • 14
  • 27
16
votes
2 answers

Why is CSP needed to protect against img-src leak?

GitHub explains the problem with img-src in "GitHub's post-CSP journey": A tag with an unclosed quote will capture all output up to the next matching quote. This could include security sensitive content on the pages such as:
griffon vulture
  • 279
  • 2
  • 6
13
votes
3 answers

Content-Security-Policy hash of script

However I still receive in Chrome: Refused to execute inline…
Steven R.
  • 417
  • 1
  • 3
  • 7
12
votes
1 answer

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-src due to a third-party component. (Both…
cis
  • 255
  • 2
  • 7
12
votes
3 answers

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that…
user2687991
  • 141
  • 1
  • 6
12
votes
2 answers

Iframe inheriting parent's Content Security Policy

I have a parent page that has a Content Security Policy on it. The main purpose of CSP is not to prevent XSS, but to prevent network access. This page has to run some user generated/submitted HTML/CSS/JS. I am running this user content in an iframe…
tapananand
  • 340
  • 3
  • 17
11
votes
3 answers

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on. I would like to detect CSP reports caused by…
Jackson Pauls
  • 111
  • 5
10
votes
1 answer

What's the difference between frame-ancestors and child-src?

Both options seem to control who can embed the content in an