search

internetstandards / Internet.nl

Internet standards compliance test suite
https://internet.nl
176 stars 37 forks source link

Is the Content Security Policy really unsafe with this 'unsafe-inline' #1229

Closed janwillemstegink closed 9 months ago

janwillemstegink commented 9 months ago

style-src data: 'self' 'unsafe-inline' shows up unsafe in https://en.internet.nl/site/nicoheimans.nl/2581042/#control-panel-29.

On the other hand a safe A+ score is shown in https://securityheaders.com/?q=nicoheimans.nl&followRedirects=on.

Which analysis is realistic?

baknu commented 9 months ago

'unsafe-inline' is broadly seen as insufficiently secure. The CSP standard itself discommends it. See:

Securityheaders.com only checks whether a Content Security Policy is available but does not evaluate its policy value. However, on the result page it offers a link to https://report-uri.com/home/analyse/https%3A%2F%2Fnicoheimans.nl%2F which also disapproves 'unsafe-inline' and states the following:

❌ 'unsafe-inline' (this value is not recommended)

janwillemstegink commented 9 months ago

Thank for the fast answer.

Scott Helme, securityheaders.com, answers: "Indeed we do for style-src, but it would degrade your score in script-src or default-src. You can find more information in my blog post on our grading criteria here: https://scotthelme.co.uk/a-balanced-approach-new-security-headers-grading-criteria/"

I suppose Internet.nl chooses to strictly follow CSP documentation.

baknu commented 9 months ago

Yes. We believe the risk with scripts is indeed greater than with styles. But still there's a risk with styles. See also: