Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSP declaration in meta tag ignored #1

Open
impca opened this issue Jun 11, 2019 · 3 comments
Open

CSP declaration in meta tag ignored #1

impca opened this issue Jun 11, 2019 · 3 comments

Comments

@impca
Copy link

impca commented Jun 11, 2019

Using latest docker image of Sitespeed (sitespeedio/sitespeed.io:latest), Coach attempts to detect CSP headers (sitespeedio/coach#315), but CSP declarations in the html source are ignored.

How to check? Create a page with CSP specified in a meta tag ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#Examples ):

<!doctype html>
<html lang="en">
	<head>
		<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self' *.domain.com;">
	</head>
	<body>
...

Then run Sitespeed and you'll still get the advice: Use a good Content-Security-Policy header to make sure you you avoid Cross Site Scripting (XSS) attacks. (contentSecurityPolicyHeader)
@soulgalore
Copy link
Member

Hi @impca aha I guess then we only check the headers. Any change you have time to do a PR to fix it? I can try to guide you?

Best
Peter

@ondras
Copy link

ondras commented Jun 11, 2019

Hi @soulgalore ,

I would like to add that HTML <meta> tags can be used to supply many more HTTP response headers. Some do not even use the http-equiv attribute:

<meta name="referrer" content="origin">

(this is a correct way to supply a referrer policy; also probably not detected by the Coach)

@soulgalore
Copy link
Member

Cool @ondras let me know if you have time to do a PR to fix that where it's applicable!

@soulgalore soulgalore transferred this issue from sitespeedio/coach Mar 11, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ondras @soulgalore @impca