Web SecurityLowWeak CSPMissing CSP

Content Security Policy Issues

A missing or bypassable Content-Security-Policy removes a key layer of XSS and injection defense.

Overview

Policies with unsafe-inline, unsafe-eval, overly broad host allowlists, or exploitable JSONP/CDN endpoints can be bypassed, neutering CSP’s protection against injected scripts.

How it works

Policies with unsafe-inline, unsafe-eval, overly broad host allowlists, or exploitable JSONP/CDN endpoints can be bypassed, neutering CSP’s protection against injected scripts.

Example

http

Content-Security-Policy: script-src 'self' 'unsafe-inline' *  // effectively no protection

Impact

Increased XSS blast radius and data exfiltration when injection occurs.

Detection

Parse the CSP for unsafe directives, wildcards, and known-bypassable hosts; flag missing policies.

Prevention

Adopt a strict nonce/hash-based policy; drop unsafe-inline/unsafe-eval.
Set object-src none and a tight base-uri and frame-ancestors.
Roll out via report-only first, then enforce.