Security finding
The Content-Security-Policy leaves out default-src, object-src or base-uri
Security Warning Severity: Medium
Part of the audit Security headers. Finding id: security.cspMissingDirectives.
What it costs you
A directive the policy leaves out is not restricted, so the policy protects less than it seems to.
What to do
Add the missing directive to the policy.
What it checks
- Policy has no default source rule
- Policy has no rule for plugins
- Policy has no rule for base address
How to fix it
Add the missing directive
- Find where the policy is set: the web server, the CDN, the application, or a <meta http-equiv> tag in the page template.
- Add the directive to the existing policy without changing the rest: default-src 'self', object-src 'none' or base-uri 'none'.
- Send the changed policy as Content-Security-Policy-Report-Only first if you are not sure what the pages load, then enforce it.
How to check: curl -sI [example url] | grep -i content-security-policy (the policy contains [directive])