Collaborate Disseminate
I’m trying to implement CSP on my site and after some research I saw that most of the sites don’t implement it or the implementation is very weak.
I also see that the implementation of the CSP is similar to HSTS and you need to insert some… Continue reading Content Security Policy
The following CSP directive violation is reported:
[csp-report]
(
[document-uri] => https://mysite.com/my-page/
[referrer] => https://www.google.com/
[violated-directive] => img-src
[effective-d… Continue reading image blocked by CSP policy even though the image is never requested
It comes to my mind a security problem that I would have accessing some data. My current problem is the following:
There is a server in AWS London where you can access some data,
by law, that data should be accessible only by Europe.
I wa… Continue reading Is using a server as bridge secure enough to protect the end data?
I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser.
A last line of defense for XSS vulnerabilities is a good c… Continue reading Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?
I’ve added CSP layer of security in my application.
Now in chrome’s web inspector, I can see CSP header in every web service response:
Content-Security-Policy: default-src ‘self’ *.intranet.myhost.com
In my application there are images wh… Continue reading Content from external sources still visible after applying CSP
Here is an extract from a CSP report
[csp-report] => Array
(
[blocked-uri] => chrome-extension
[column-number] => 27329
[document-uri] => https://www.mysite.com/mypage/
[line-number] => 3
… Continue reading chrome-extension as source of CSP policy violation
I’m evaluating a CSP policy using https://csp-evaluator.withgoogle.com/. The policy is configured as follow:
default-src ‘self’;object-src ‘self’;script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’;script-src-elem ‘self’ ‘unsafe-inline’ ‘unsaf… Continue reading Why only script-src unsafe-inline is reported as a high severity finding?
If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed ‘inline-script’ would my site still be at risk by allowing base64 encoded image data to be painted onto images that might hav… Continue reading CSP allowing Base64 encoded images without unsafe-eval
This holiday season more and more e-commerce site operators will be deploying web app security solutions such as content security policies (CSPs) to protect themselves and their users against cyberattacks, including cross-site scripting (XSS), formjac… Continue reading Web App Security: Don’t Let the Code Injection Grinch Steal Holiday Joy
I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. The e-mail template itself is defined … Continue reading Safely render HTML template with inline CSS from trusted domain (it forces the use of "style-src: unsafe-inline" in CSP)