CODEWITHSUNDEEP
securitywebbrowsercross-domaincontent-security-policy
alfa
alfa

Reputation: 35

How does the browser respond if the Content Security Policy is different across multiple HTTP responses from the same Origin

If a browser requests a resource from a URI, and the CSP header from the first response indicates only to load resources from 'self', ie: 

Content-Security-Policy: default-src 'self'

But subsequent requests for resources to the same origin return a more lenient CSP in their header, ie:

Content-Security-Policy: default-src 'self' *.trusted.com

Does the browser apply the most permissive policy indicated?

Upvotes: 0

Views: 102

Answers (1)

alfa
alfa

Reputation: 35

"The browser does not persist CSP policies across responses, and doesn’t between responses maintain any state information about policies from previous responses." - as above

Upvotes: 0

Related Questions