CODEWITHSUNDEEP
javaspringjspcontent-security-policy
Jannik
Jannik

Reputation: 1015

Disable Content Security Policy in JSP/Spring

Within my view.jsp file I'm using the "object"-tag to link to another page. It's looks like:

<object
 data="https://thisIsAnExample"
 height="540" style="overflow: hidden;" type="text/html" width="960">
</object>

But when invoking the view it says:

Blockt from the Content Security Policy.

I already tried to add some meta data in the head of the .jsp file like 

<meta http-equiv="Content-Security-Policy" content="object-src 'https:/thisIsAnExample';">

or

<meta http-equiv="Content-Security-Policy" content="sandbox">

But nothing works!
Are there any recommendations?
Thanks!

Upvotes: 1

Views: 3591

Answers (1)

Mike Samuel
Mike Samuel

Reputation: 120476

<meta http-equiv> doesn't affect CSP when there's a Content-Security-Policy header by design. If it did, then an attacker who could inject content could override the Content-Security-Policy and inject a script. See also https://stackoverflow.com/a/41345974/20394

You'll have to modify the code that generates the Content-Security-Policy header to add an object-src like

object-src https://thisIsAnExample;

Note that quotes are not required.

If there's a security specialist on your team, talk to them.

Upvotes: 2

Related Questions