Details
Alert Id 10038
Alert Type Passive Scan Rule
Status beta
Risk
CWE
WASC

Summary

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

Solution

Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: 'Content-Security-Policy' for Chrome 25+, Firefox 23+ and Safari 7+, 'X-Content-Security-Policy' for Firefox 4.0+ and Internet Explorer 10+, and 'X-WebKit-CSP' for Chrome 14+ and Safari 6+.

References

Code

org/zaproxy/zap/extension/pscanrulesBeta/ContentSecurityPolicyMissingScanRule.java