Details
Alert ID 90004-1
Alert Type Passive
Status beta
Risk Low
CWE 693
WASC 14
Technologies Targeted All
Tags CWE-693
OWASP_2017_A03
OWASP_2021_A04
POLICY_PENTEST
POLICY_QA_STD
More Info Scan Rule Help

Summary

Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.

Solution

Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages. 'same-site' is considered as less secured and should be avoided. If resources must be shared, set the header to 'cross-origin'. If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).

Other Info

References

Code

org/zaproxy/zap/extension/pscanrulesBeta/SiteIsolationScanRule.java