Security

`security/csp-strict`

Production pages send a strict Content Security Policy (nonces or hashes with strict-dynamic, object-src none, base-uri none).

moderatebrowserfe-security

Why

A CSP is the second line of defence against XSS: when an injection slips through, the browser refuses to run script the policy did not allow. Allowlists of domains are easy to bypass; 'unsafe-inline' and 'unsafe-eval' switch the protection off.

Fix

Send script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none' with a fresh unguessable nonce per response (server-rendered apps), or hashes of inline scripts for static sites. Roll out with Content-Security-Policy-Report-Only first and a reporting endpoint, then enforce. Next.js, Nuxt, SvelteKit and Astro document nonce or hash support; use it instead of hand-writing headers.

Examples

Content-Security-Policy: script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'

Sources

Facts

Id: security/csp-strict
Severity: moderate
Check: browser needs a rendered page: audit --url
Applies to: page
Same problem in: Lighthouse csp-xss
Taught by the skill: fe-security Front-end security
Since version: 0.1.0

Rule file on GitHub

Read it in the terminal

npx github:dawidolko/frontend-skills explain security/csp-strict