0
287
ViewsWhy Inline Javascript is executed without error when Content-Security-Policy header is defined but not inline-script directive
According to the CSP website, When you have a Content-Security-Policy header defined, the browser will automatically block inline scripts.
However after removing all my other directives just left with Content-Security-Policy: script-src 'self' https: http:, my inline script is executed without error, why is that?
What I expect is my browser should block any inline javascript to run. Then that is where nonce, hashes and unsafe-inline comes in.
My inline javascript
<script>
function test() {
console.log("inline javascript is executed")
}
test();
</script>
CSP Browser Test (Chrome Version 100.0.4896.127 (Official Build) (x86_64) )
Safari Test Result gives me correct errors but Chrome will run inline scripts without errors
1 answers
Answer question0
i've put this small PHP file on my local xampp for testing...
first two notations are blocking the alert and the last allows it. Tested on
- Chrome v103.0.5060.114 x64
- Edge 103.0.1264.49 x64
- Firefox 102.0.1 x64.
All browsers create an error message on the console that the inline execution of a script has been blocked because of CSP.
<?php
// no alert
//header("Content-Security-Policy: script-src 'self' http: https:", true);
// no alert
header("Content-Security-Policy: script-src 'self'", true);
// alert
//header("Content-Security-Policy: script-src 'self' 'unsafe-inline'", true);
?><html>
<head><title></title></head>
<body>
<script>alert('test');</script>
</body>
</html>
Troubleshooting ideas:
- Check the console if there CSP header is recognized or if there are unprintable chars or other syntax errors
- Are there browser addons that are modifying incoming headers
- Is there a security software running that is modifying incoming headers
- Is a proxy server blocking the headers