Security

`security/csp-meta-ignored`

frame-ancestors, report-uri, sandbox and X-Frame-Options are sent as HTTP headers; in a meta tag they do nothing.

Why

Browsers ignore these settings when they come from a <meta> tag, so the page looks protected in the source but can still be framed by any site (clickjacking) and violations are never reported.

Fix

Send Content-Security-Policy (with frame-ancestors 'none' or 'self') and, for old browsers, X-Frame-Options: DENY as response headers from the server or the host's headers file. A meta CSP is fine for the directives it supports (script-src, default-src, object-src, base-uri), placed early in <head>.

Examples

# _headers
/*
  Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'none'
  X-Frame-Options: DENY

Sources

Facts

Id: security/csp-meta-ignored
Severity: moderate
Check: static checked in the source by audit
Applies to: html vue svelte astro jsx
Taught by the skill: fe-security Front-end security
Since version: 0.1.0

Rule file on GitHub

Read it in the terminal

npx github:dawidolko/frontend-skills explain security/csp-meta-ignored