default-src Used in Content Security Policy (CSP)

Summary #

Netsparker detected that you used default-src in CSP directive. It is important to know that default-src cannot be used as a fallback for the functions below:

base-uri

form-action

frame-ancestors

plugin-types

report-uri

sandbox

Classifications #

ISO27001-A.14.2.5; OWASP PC-C9

Further Reading #

Content Security Policy (CSP) Explained

Netsparker Security Insights #

Using Content Security Policy (CSP) to Secure Web Applications
Remote Hardware Takeover via Vulnerable Admin Software
The dangers of incorrect CSP implementations
Leverage Browser Security Features to Secure Your Website

Vulnerability Index

You can search and find all vulnerabilities

Select Category

Critical
High
Medium
Low
Best Practice
Information

Search Vulnerability

Tags

CSP

Related Vulnerabilities

Blind SQL Injection
SQL Injection
Local File Inclusion
Misconfigured Access-Control-Allow-Origin Header
Missing X-Frame-Options Header

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo