Collaborate Disseminate
Today I created a web application. I’m using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src ‘none’; connect-src ‘none’; default-src ‘none’; font-src ‘none’; frame-src ‘none’; img-src ‘none’; manifest-src ‘non… Continue reading Is it possible to bypass this csp?
Does the design and implementation of the content security policy standard allow for the introduction of new unsafe behavior that wasn’t there prior to having any CSP at all?
For example if my starting point is having no CSP headers or pol… Continue reading Can a Content Security Policy (CSP) enable *new* unsafe behavior?
The W3C spec for Content-Security-Policy or Mozilla CSP docs would be the definitive source for this answer, but it does not seem covered, so I’m asking here for answers based on people’s experience. If my understanding is correct, then I’… Continue reading On what types of web content is a Content-Security-Policy useful?
I am having trouble finding information on the implications of using https: and data: as a source
for the directives in a CSP.
Example:
img-src ‘self’ https: data:;
Could someone some context around what these two sources mean and if the… Continue reading Content Security Policy https: and data: meaning
We’ve recently conducted a security review of our identity server website and one of the finding was about missing CSP header. We do have implementation of request filter to add CSP on a controller level. So my question is, is there any do… Continue reading When is content security policy (CSP) not appropriate?
I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script’s URL isn’t properly secured and my.remote.domain.com isn’t whitelisted as an allowed domain to load and execute scripts from.
Example (code ru… Continue reading Vulnerability detection tool that scans for dynamic script tag appending to DOM
What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don’t want the js handlers to be executed, why not … Continue reading Example of script-src-attr that is not already handled by script-src-elem
I would like to know peoples’ thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect against XSS and etc, but I been using Mozilla… Continue reading Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc
This may already have been answered, but I’m having difficulty understanding the technical jargon of various posts.
I have to give a Callback URL to receive some sort of validation, to use an API. Does providing my localhost url (https://…. Continue reading Noob question on security of localhost
We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an iframe.
During a recent scan by our securi… Continue reading Prevent XSS in 3rd party (self hosted) application