Content Security Policy - Using them in HTTP response header
Karthikeyan J
This request was created on behalf of Basil
Currently, the content security policy tag is added to the meta tags.
However, most of the sites such as https://securityheaders.com/ will check the HTTP response header to identify the tag and evaluate the website.
It would be great if we have an option to select where we want to use the tags.
Thank you.
Log In
Arunkumar Kumaresan
Content Security Policy is currently applied only via an HTML meta element in the page source rather than as an actual HTTP response header. Automated security scanning tools that inspect response headers do not detect the policy and report it as absent, even though it is enforced in the browser.
Suggested Enhancement: Offer an option to deliver Content Security Policy (and related headers such as X-Frame-Options) as genuine HTTP response headers, in addition to or instead of the current meta-tag delivery method.
Customer Benefit: Security scans and compliance audits that check response headers directly would accurately reflect the policy already in effect, removing false "missing header" findings and the manual explanation currently required to interpret scan results.
Ramesh Lokesh
Tuscany Basilisk
I
Industrial Reindeer
CSP needs to be implemented in response headers as well along with Meta tag as suggested by security score card until and unless it is implemented in response header they won’t mark it as fixed.
Ideal Fix: Content-Security-Policy: default-src 'self'; script-src 'self' https://apis.example.com; object-src 'none'; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com;