| Details | |
|---|---|
| Alert ID | 10055-13 |
| Alert Type | Passive |
| Status | release |
| Risk | Medium |
| CWE | 693 |
| WASC | 15 |
| Technologies Targeted | All |
| Tags |
CWE-693 OWASP_2017_A06 OWASP_2021_A05 |
| More Info |
Scan Rule Help |
Summary
The Content Security Policy fails to define one of the directives that has no fallback. Missing/excluding them is the same as allowing anything.
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.Other Info
The directive(s): frame-ancestors is/are among the directives that do not fallback to default-src.References
- https://www.w3.org/TR/CSP/
- https://caniuse.com/#search=content+security+policy
- https://content-security-policy.com/
- https://github.com/HtmlUnit/htmlunit-csp
- https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources