Content security policy value for Inspector is not proper

Recomended Controls : it is recommended to 1. support standard content security policy header 2.

avoid the unsafe-inline directive 3. avoid the unsafe-eval directive 4. never specify a wildcard(*) as the

default policy 5. never specify a wildcard (*) when referencing top level domains (e.g. *.com)

Risk : these functions (java_script operator and function eval(), function() constructor, settimeout()

method without a function as the first argument and setinterval() method without a function as the

first argument) are dangerous in that they can cause a web application to execute user input as

java_script code. it may leads to xss and code injection attacks

Because of the above security concern we want only the below content security policy value in the inspector URL. when we are applying below below value page is not working with the default value page is working fine.

"Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'self' "

Needed By

Month

Post comment

Admin

Manojkumar K M

Reply
| Mar 18, 2025

Thanks for reaching out to us. We are currently reviewing this request and will keep You Informed about its feasibility.

0 reply Hide replies

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Please enter your email address

RELATED IDEAS

Content security policy value for Inspector is not proper