Permissive Content Security Policy Detected

low Web App Scanning Plugin ID 112554

Language:

Synopsis

Description

Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.

One or several permissive directives have been detected. See output for more details.

Solution

Content Security Policies are designed to have control over where resources on a website can be loaded from. Implementing a policy depends on the application type (web applications, APIs...) and the directives have to be specified according to this.
For web applications, The following directive configurations can usually be applied to restrict the policy:

- 'frame-ancestors' should be set to 'none' to avoid rendering of page in <frame>, <iframe>, <object>, <embed>, or <applet>.
- 'form-action' should be explicitly set to 'self' to restrict form submission to the origin which the protected page is being served.
- Any of the 'unsafe-*' directives indicate that the action is considered unsafe and it is better to refactor the code to avoid using HTML event handlers that rely on this.
- data: https: http: URI in 'default-src', 'object-src', 'base-uri' & 'script-src' allow execution of unsafe scripts and should not be set.
- * and *.* in 'script-src' and other '-src' directives allows execution of unsafe scripts and should be restricted.
- 'default-src' should be explicitly set to 'self' or 'none' and individual directives required for each source type set more permissively as required
- * and *.* in 'default-src' allows various unconfigured parameters to default to a unsafe configuration and then should not be set.

For APIs, there should not be any need to load resources like scripts or frames, so specifying a strict policy using default-src 'none' and frame-ancestors 'none' is recommended.

If some unsafe directives are required for business continuity in your environment, apply mitigating controls suitable for your environment and work with the vendors of the products for which these directives are required. Note that different CSP versions exist, and that some of the directives may not work depending on the browser versions used when accessing the web application.