Questions tagged [content-security-policy]

Content Security Policy (CSP) aims to mitigate the risk of cross-site scripting attacks by giving developers fine-grained control over the resources a page is allowed to load, as well as the script it's allowed to execute.

Filter by
Sorted by
Tagged with
0 votes
1 answer
47 views

How to add nonce attribute in Angular 16 for scripts and styles created dynamically?

I'm adding Content-Security-Policy header in an application using Angular 16 to avoid XSS attacks. I added ngCspNonce attribute to the tag in index.html and set random nonce value on the server side. ...
mra's user avatar
  • 1
0 votes
0 answers
16 views

General Manifest V3 eval() disabed workaround

I'm trying to make a bookmarklet to Manifest V3 chrome extension converter (V2 already exists) but becuase eval() is disabled I can't find a way to convert any given bookmarklet to a functioning ...
Gabe's user avatar
  • 25
0 votes
0 answers
10 views

Google Tag Manager - violates CSP

I have found few question asking this already but any of them resolver my issue. 70099772 76660492 69005123 to name a few I'm trying to implement CSP into site I'm currently developing. App is written ...
ciekals11's user avatar
  • 2,032
0 votes
1 answer
14 views

How to Play External Audio Files Violating Content Security Policy Directive in a Chrome Extension?

I am developing a Chrome extension that enables users to send selected text to a server, which then converts it into speech and returns an MP3 URL for playback. However, on certain websites, I ...
Nori's user avatar
  • 2,370
0 votes
1 answer
11 views

How can unsafe-inline in the src-script directive in CSP expose a website to XSS attacks?

How can unsafe-inline in the src-script directive in CSP exposes a website to XSS attacks?
Bionix1441's user avatar
  • 2,139
0 votes
1 answer
36 views

ASP.NET CORE Refused to frame 'https://app.powerbi.com/' because it violates the following Content Security Policy directive: "default-src 'self'"

I'm trying to frame a bi report in my ASP.net core application (currently run using IIS). It works fine when ran in visual studio but when I try to run it through IIS I keep getting "This ...
caitlin wardle's user avatar
1 vote
1 answer
38 views

inline event handler nested within a javascript - Refused to execute inline event handler because it violates the following Content Security Policy

Preface: Hashes belonging to all known or identifiable Javascripts have been included in the CSP Header. When I click on the custom Facebook share button, I get the following error: Refused to ...
Goemon Code's user avatar
0 votes
0 answers
32 views

Content Security Policy directive: "script-src 'none'"

I faced the issue that on my webpage sometimes I am getting the error from content security policy that -> [Report Only] Refused to execute inline script because it violates the following Content ...
Beka Lobzhanidze's user avatar
0 votes
0 answers
36 views

JS in chrome extension popup violates Content Security Policy

I am trying to write a Chrome Extension (actually running on Edge) where I interact with a popup window. When I try to include a JS file and open the popup, I get: Refused to execute inline script ...
jrw's user avatar
  • 51
0 votes
1 answer
55 views

Content Security Policy (CSP) in Next.js - how to pass it to full application?

I'm using Next.js and a separate express backend in a project, and want to implement a Content Security Policy (CSP), with nonces as I have understood this is best practice. According to next.js ...
Oscar Ekstrand's user avatar
0 votes
1 answer
40 views

What is causing a hyperlink to force a request without cookies?

Here is the setup: user authenticates on website example.org user goes to stripe.com user clicks a hyperlink that takes them back to example.org At #3 I would expect user to load example.org as ...
Gajus's user avatar
  • 69.2k
0 votes
0 answers
12 views

content security policy frame-ancestor directive vs x-frame-options http header

As per my understanding, X-Frame-Options header have X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN WHen i read about CSP Frame-ancestors, it is also having Content-Security-Policy: frame-ancestors ...
Amulya's user avatar
  • 1
1 vote
0 answers
10 views

Why doesn't set-header work when requesting express static file url?

I am checking web vulnerabilities with 'ZAP'. And I set up static files in express. var express = require('express'); const options = { etag: false, setHeaders: function (res, path, stat) { res....
Sungeun Song's user avatar
1 vote
0 answers
25 views

how to configure content security policy header in codeigniter 3

Please anyone provide solution how do I set the content security policy header in code igniter 3? I tried a lot but nothing happen. thanks I am doing like this $this->output->set_header('Content-...
Shubham Nayak's user avatar
0 votes
0 answers
20 views

Webpack content security policy problem with loadCSS

I'm trying to implement a strict csp with an existing production project The problem I am currently facing is that something is injecting the following: PostCSS javascript inline !function(n){"...
João Pedro Lopes Mendes's user avatar
0 votes
2 answers
23 views

How Content Security Policy should work with SPA?

We have two UI on SPA, one its app itself and another login UI. App calls several our backend services mostly API. Penetration testing showed that we must add CSP header. Strange that in testing ...
Рома Матковский's user avatar
-1 votes
0 answers
60 views

Content Security Policy directive: "frame-ancestors 'self'"

After trying all options, I am questioning here. I am trying to implement MPGS direct API but in one api call where i have to load an iframe, I am getting below error. [Report Only] Refused to frame '...
Assad Nazar's user avatar
  • 1,418
0 votes
1 answer
23 views

CSP frame-ancestors self directive blocks page served from same origin

I have a nodejs app which serves index.html for "/" route test.html for "/test" route app.get("/", (req, res) => { res.sendFile(path.join(__dirname + "/index....
Phalgun's user avatar
  • 1,213
0 votes
0 answers
41 views

Configure content security policy according to office uri scheme

I am trying to configure a content security policy for a Java web application. I am currently overriding the init method of Webapplication like this: final CSPHeaderConfiguration ...
Alexander Holland's user avatar
0 votes
3 answers
23 views

Security headers sent from the backend while the frontend is hosted separately

Is there any value in sending security headers like Content-Security-Policy (I am mainly thinking of using Helmetjs) from the backend, if it is used as an APIs and the frontend is served separately by ...
aldokkani's user avatar
  • 863
0 votes
1 answer
10 views

Can you put CSP headers or some other headers on your cdn

I have 2 urls: is for my main domain where I serve my content: https://example.com is for my images cdn from where I serve images https://images.example.com Are there any CSP headers I can add to ...
Vjerci's user avatar
  • 538
0 votes
1 answer
38 views

Reading cookies from a different domain with CSP

I am setting a secure, http only, same site none cookie on www.domain-a.org express server. Using CORS and CSP I want to fetch that cookie from www.domain-b.com which also uses express. Every time a ...
user1307016's user avatar
0 votes
1 answer
32 views

Problem with applying CSP policy for Google fonts file

I'm working on Django site (upgrade from version 2 to version 4), where I have to apply Content Security Policy. In other projects I did it with django-csp using project's settings, but in this case I ...
Artur's user avatar
  • 445
0 votes
0 answers
19 views

Content Security Policy is set, but not detected

I have django-csp version 3.7 (https://pypi.org/project/django-csp/). It is added to the middleware section: MIDDLEWARE = [ 'csp.middleware.CSPMiddleware', 'django.middleware.security....
Omid Shojaee's user avatar
0 votes
0 answers
42 views

Modify response headers in Chrome Extension manifest v3

I build an extension for Chrome, and need to modify Content-Security-Polity response header of any website in order to be able to inject JavaScript loaded the from remote host, so I need to add my ...
Oleg's user avatar
  • 22.3k
1 vote
0 answers
22 views

Upgrading .Net5 Mvc To .Net7 Mvc Caused Content Security Policy Error

I am trying to learn .net mvc. My instructor used .net5 on the course, but I want to build it with .Net 7. I did the necessary things (startup.cs=>program.cs conversions). So there are 2 .Net7.0 ...
L_Karapetti's user avatar
0 votes
1 answer
23 views

Security implications of allowing 'https' in CSP connect-src

What are the security implications of allowing 'https' for 'connect-src' in my CSP? I understand that an attacker would technically be able to send information to any URL (though not sure how), but ...
Espen's user avatar
  • 2,133
0 votes
1 answer
81 views

How to dynamically replace the value of ngCspNonce in Angular hosted on Azure

I have an Angular 14 application hosted in Azure. I am implementing the Content Security Policy in the app. I don't want to use 'unsafe-inline' to load third party inline styles. I followed this ...
Gagandeep Singh's user avatar
0 votes
0 answers
22 views

How to safely change CSP with Play Framework

I have a web app in production with a CSP configured through Play Framework's application.conf as described at https://www.playframework.com/documentation/2.8.x/CspFilter Now I want to make a change ...
Roman Zabicki's user avatar
0 votes
2 answers
55 views

Content-Security-Policy: The page’s settings blocked the loading of a resource at xyz.com (“default-src”) issue

I'm getting the following issue: Content-Security-Policy: The page’s settings blocked the loading of a resource at blob:https://test.com/ff851-924-4522-8b74-f1d4f8c9f (“default-src”). whenever I ...
NeERAJ TK's user avatar
  • 2,472
0 votes
0 answers
18 views

correct CSP for phpMyAdmin with OpenLiteSpeed

Not able to access phpMyAdmin after installation on AWS EC2 with Ubuntu with openLiteSpeed I have been trying various configurations of CSP headers and get the below with this set: set Content-...
Marlon Montgomery's user avatar
0 votes
0 answers
27 views

Content Security Policy to include Chrome extension

I have a web application that has a Content Security policy with script-src 'self'. However, there is a Chrome extension that uses scripting specifically on our site that is currently being blocked by ...
heath's user avatar
  • 1,059
0 votes
0 answers
9 views

Joomla 4 CSP and SVGATOR

Created animated svgs in svgator (containing js)) which are being blocked by the CSP in Joomla 4. Could anyone please assist in the correct settings for the System > HTML Headers plugin Content-...
jimmywiddle's user avatar
0 votes
0 answers
56 views

Content Security Policy directive: "frame-src 'self' data:"

I have an app, in which the user would be able to copy an image URL, paste it unto an input and the image will be loaded on a box. vendors.fbdee1b68a2292d6de96.chunk.js:2 Refused to frame 'https://...
flash's user avatar
  • 75
0 votes
0 answers
16 views

CSP hash values for external files which change - hash no longer valid

I have recently been tightening up the content security policies for one of my sites. This site uses font awesome for its icons. As part of this, I've included https://*.fontawesome.com/ under several ...
penguin178's user avatar
0 votes
0 answers
10 views

Chrome Extension - Force-inject inline script with Manifest V3 [duplicate]

In a manifest V2 extension content script, the following worked fine: var script = document.createElement('script'); script.textContent = 'console.log("hello")'; document.head.appendChild(...
Codesmith's user avatar
  • 5,799
0 votes
3 answers
156 views

Content-Security-Policy for styles with React and Material-UI v4

There is a React UI that uses material-ui version 4. In Production the web server is embedded into a JVM application. The UI is built with npm and then the bundle is deployed along with the server ...
DorianTyrrell's user avatar
1 vote
1 answer
33 views

Embed Twitter timeline in al-folio website on github pages

I am using the al-folio template to build a personal website that I will host on github pages. I would like to embed my Twitter timeline. If I go to https://publish.twitter.com/, and input https://...
hyperio's user avatar
  • 411
0 votes
0 answers
8 views

How to make a contemporary browser treat a `srcdoc`-based iframe as if it was served from a different origin?

From my understanding, serving untrusted content in an iframe with a different origin is desirable, as browsers’ native mechanisms for isolating origins from each other have necessarily evolved to be ...
Anton Strogonoff's user avatar
1 vote
0 answers
67 views

Plugin being blocked by CSP - even at localhost

How are we to have plugins that aren't hosted on the same domains as Banno actually load as widgets? Every time that I try something that isn't localhost it gives me a CSP error. And even when I, as ...
charlesread's user avatar
0 votes
0 answers
139 views

How can I fix jQuery 3.7.0 inline script violation with CSP

jQuery 3.7.0. has a line of code that violates CSP policies for inline scripting that has been persisting since version 3.1.1, seeing as it is clearly not getting fixed anytime soon I was wondering if ...
JSG's user avatar
  • 1
0 votes
0 answers
53 views

How to block only redirects via HTML meta tag with CSP

Scenario Given there's the following HTML markup, which is the result of a successfully XSS injection attempt: <!-- this meta tag was successfully injected/prepended --> <meta http-equiv=&...
Oliver Hader's user avatar
  • 4,088
0 votes
2 answers
45 views

Console showing "Note that 'img-src' was not explicitly set" CSP error even when 'img-src' is set with Electron

In an Electron renderer, I am trying to load an image via a custom protocol but in the renderer console I am getting the following error: main_window:13 Refused to load the image 'dir://pumpjack.png' ...
Nik333's user avatar
  • 58
0 votes
0 answers
75 views

Content Security Policy - Blocking resources even with nginx config

It seems I am running into an issue where my app is running into CSP restrictions. For testing purposes I included into my config: add_header Content-Security-Policy "default-src 'self' data: ...
BLBug's user avatar
  • 13
0 votes
0 answers
50 views

Content Security Policy causing 502 for WordPress admin login page

I've been setting CSP rules in my .htaccess for a WordPress site. At some point, something I've added causes this to happen: go to site.com/wp-admin to login to WordPress admin area as usual the page ...
bluedimensional's user avatar
0 votes
0 answers
4 views

navigate-to is Unimplimented. Are there any alternative

The Content Security Policy navigate-to directive are not implementet. https://content-security-policy.com/navigate-to/ Does there exist any alternative to block navigation to any external urls? (Be ...
Anders Den's user avatar
-1 votes
1 answer
30 views

Content-Security Header throwing me error

I am adding a Content-security-policy headers in my application by provide the following value of directive as the style-src:'unsafe-inline" script-src: www.googletagmanager; font-src: 'self' ...
Tushar's user avatar
  • 1
0 votes
1 answer
50 views

Content Security Policy not working in magneto 2

I have added chat script in magneto 2 using https://r0.cloud.yellow.ai I get the following error. Refused to connect to 'wss://r0.cloud.yellow.ai/websocket/' because it violates the following Content ...
Grace's user avatar
  • 21
0 votes
0 answers
28 views

Not able to use Vue JS via CDN file inside Firefox Extension

I am trying to create a Firefox extension and have it ready in Vue JS. I am using the Production CDN version of Vue JS from here This is what my manifest.json looks like: { "name": "...
Shahid Shaikh's user avatar
0 votes
1 answer
69 views

How to configure flask-talisman for CDN scripts and cron jobs in python 3.11 standard google app engine

Following the suggestion in the docs, I added flask-talisman but have run into two problems. I'm using apexcharts from CDN and I don't know how to get the nonce right - otherwise I get an error on ...
dugloon's user avatar
  • 196

1
2 3 4 5
53