Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

CSP declaration in meta tag ignored #1

Open
impca opened this issue Jun 11, 2019 · 3 comments
Open

CSP declaration in meta tag ignored #1

impca opened this issue Jun 11, 2019 · 3 comments

Comments

@impca
Copy link

impca commented Jun 11, 2019

Using latest docker image of Sitespeed (sitespeedio/sitespeed.io:latest), Coach attempts to detect CSP headers (sitespeedio/coach#315), but CSP declarations in the html source are ignored.

How to check? Create a page with CSP specified in a meta tag ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#Examples ):

<!doctype html>
<html lang="en">
	<head>
		<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self' *.domain.com;">
	</head>
	<body>
...

Then run Sitespeed and you'll still get the advice: Use a good Content-Security-Policy header to make sure you you avoid Cross Site Scripting (XSS) attacks. (contentSecurityPolicyHeader)
@soulgalore
Copy link
Member

Hi @impca aha I guess then we only check the headers. Any change you have time to do a PR to fix it? I can try to guide you?

Best
Peter

@ondras
Copy link

ondras commented Jun 11, 2019

Hi @soulgalore ,

I would like to add that HTML <meta> tags can be used to supply many more HTTP response headers. Some do not even use the http-equiv attribute:

<meta name="referrer" content="origin">

(this is a correct way to supply a referrer policy; also probably not detected by the Coach)

@soulgalore
Copy link
Member

Cool @ondras let me know if you have time to do a PR to fix that where it's applicable!

@soulgalore soulgalore transferred this issue from sitespeedio/coach Mar 11, 2020
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ondras @soulgalore @impca