Closed dataCollegechurch closed 3 years ago
From MDN
Elements controlled by object-src are perhaps coincidentally considered legacy HTML elements and aren't receiving new standardized features (such as the security attributes sandbox or allow for
Ideally you'd set object-src
to 'none'
.
Also please note that the CSP you pasted can be bypassed in several ways (AngularJS and jsonp endpoints hosted on the domains you're allowing in script-src
)
default-src 'self'; script-src 'self' cdnjs.cloudflare.com www.google-analytics.com www.googletagmanager.com; img-src 'self' www.google-analytics.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdnjs.cloudflare.com; font-src 'self' fonts.gstatic.com cdnjs.cloudflare.com; form-action 'self'; report-uri https://scotthelme.report-uri.com/r/default/csp/enforce
With this policy in place there is a warning for object-src [missing]. Is this desired functionality considering there is default-src directive?