Programming Tutorials

Content-Security-Policy: object-src, script-src, base-uri and report-uri

By: Niraj in WebServices Tutorials on 2023-03-29  

The Content-Security-Policy (CSP) header you provided sets several security policies for your website. Here's a breakdown of what each directive does:

• object-src 'none';: This directive specifies that no content from any other origin can be embedded as an object within your website.

• script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;: This directive specifies where scripts can be loaded from on your website.

  • 'nonce-{random}': This allows scripts to be loaded from inline script elements that contain a randomly generated nonce attribute. This helps to mitigate against certain types of cross-site scripting (XSS) attacks.

  • 'unsafe-inline': This allows inline scripts to be executed. Inline scripts are generally discouraged as they can introduce security vulnerabilities.

  • 'unsafe-eval': This allows the use of eval() and new Function() for script execution on your website. As mentioned earlier, this can introduce security vulnerabilities and should be used with caution.

  • 'strict-dynamic': This allows scripts to be loaded dynamically at runtime using trusted functions. This helps to mitigate against certain types of XSS attacks.

  • https: http:;: This specifies that scripts can be loaded from any https or http source. However, it's generally recommended to only allow scripts to be loaded from trusted sources over https.

• base-uri 'none';: This directive specifies that no URLs can be used as the base URL for resolving relative URLs. This helps to prevent certain types of injection attacks.

• report-uri https://your-report-collector.example.com/: This directive specifies the URL to which a violation report is sent if a policy is violated. This can be used to track and investigate security issues on your website.

Overall, this CSP header helps to enforce a number of security policies on your website, but it's important to ensure that the policies are tailored to your website's specific needs and that you are regularly reviewing and updating them as necessary.