Protocol: CSP Allowlisted Script Resources¶

Identifier: csp_allowed_scripts

Scanner(s) Support¶

Description¶

A Content-Security-Policy whose script-src directive relies on broad host allowlists (for example https:, http:, or many third-party domains) provides weaker protection than nonce- or hash-based policies. If any allowlisted origin hosts attacker-controlled scripts, JSONP endpoints, or script gadgets, the policy can be bypassed while still appearing configured.

How we test: We parse the Content-Security-Policy header and flag script-src directives that trust external hosts or scheme wildcards instead of nonce-, hash-, or 'strict-dynamic'-based controls.

References:

• OWASP Content Security Policy Cheat Sheet
• OWASP Web Security Testing Guide: Test for Content Security Policy
• Content Security Policy Level 3
• On the Insecurity of Whitelists and the Future of CSP (W3C WebAppSec)

Configuration¶

Example¶

Example configuration:

---
security_tests:
  csp_allowed_scripts:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.