What Content-Security-Policy (CSP) Directives are Assessed?

Content-Security-Policy (CSP) directives are in-depth controls, and the absence of those directives does not automatically make a website or service exploitable. However, when used, their presence indicates a company has a good cyber security posture.

• Objectives
• Directives
• Considerations
• Checks

Objectives

• Application privilege limitation - The CSP uses the form-action directive to limit application privilege.
• Application privilege limitation - The CSP uses the object-src directives to limit application privilege.
• Code Injection Prevention - This requires the website to be designed or refactored with CSP in mind. The user specifies explicit hosts for source-list directives and does not use the unsafe-inline or unsafe-eval keywords. This objective is not met if any of the source-list directives are improperly set or incomplete.
• Reporting - The CSP specifies a reporting location through a reporting directive. If either the report-to or report-uri directive is present, the reporting objective is considered to be satisfied.
• Resource Embedding Prevention - The CSP uses frame-ancestors (or X-Frame-Options) to prevent resource embedding attacks.

Directives

Considerations

• CSP in HTML is considered only if:
  • The HTML head element is an ancestor.
  • The policy is inside a meta element, like so:

    http-equiv="Content-Security-Policy"

    This is case sensitive.

  • The element has a content attribute.
  • The directive is known.
• CSP defined in meta tags don’t support the following directives:
  • report-uri
  • frame-ancestors
  • sandbox

Checks

• The syntax of CSP directives is checked for correctness of the data, duplicate directives, and if optional/known directives are added.
• Multiple headers are allowed.
• Either the X-Frame-Options or frame-ancestors directive should be present and correctly set.
• Reporting should be present and there should be a directive for logging errors.
• There should already be an annotation indicating that the required header is missing. This is indicated if the CSP record is report only, which is a type of CSP record that has the specific Content-Security-Policy-Report-Only header instead of Content-Security-Policy.