CME-905
Content Security Policy (CSP) Headers
Description
Browser-enforced HTTP header policy that restricts script sources, prevents inline execution, and blocks mixed content. Defense-in-depth against stored/reflected XSS that catches output encoding failures. CSP's frame-ancestors directive also mitigates clickjacking.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | CSP script-src directive restricts script execution to enumerated origins; injected inline scripts are blocked by the browser's enforcement engine regardless of payload encoding or obfuscation |
CWE Relationships
Verification
Verify CSP header is present with effective script restrictions
$ curl -sI http://<target>/ | grep -i content-security-policy
# Expected: Content-Security-Policy:
# Expected: Content-Security-Policy:
Platform: any
$ curl -sI http://<target>/ | grep -i content-security-policy | grep -ic 'unsafe-inline'
# Expected: 0
# Expected: 0
Platform: any
$ curl -sI http://<target>/ | grep -i content-security-policy | grep -ic 'unsafe-eval'
# Expected: 0
# Expected: 0
Platform: any