CODEWITHSUNDEEP
reactjscontent-security-policyrails-api
Ju lien
Ju lien

Reputation: 1

Browser doesn't apply the CSP received from HTTP headers?

here is my aim : implement a Content Security Policy backend side and apply it frontend side through the browser. here is the issue : none of the rules set up are effective frontend side.

What I tried : I created a CSP that blocks any resource (on purpose for a test).

I can see that the CSP is sent by backend and received in browser (from HTTP headers in Firefox's Network tab).

    content-security-policy : default-src 'none'; script-src 'none'; style-src 'none'; img-src 'none'; font-src 'none'; connect-src 'none'; frame-src 'none'; object-src 'none'; media-src 'none'; worker-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'

But none of these rules are effective : js scripts are executed, images from any domains are visible etc.

Finally, when I set up the CSP in the index.html frontend side : the CSP is working. But it's not the best practice.

How can I make the CSP be applied when sent through HTTP headers ?

My config :

Upvotes: 0

Views: 54

Answers (0)

Related Questions