javascript - Allow All Content Security Policy? - Stack Overflow

admin管理员组

文章数量:1135604

Is it possible to configure the Content-Security-Policy to not block anything at all? I'm running a computer security class, and our web hacking project is running into issues on newer versions of Chrome because without any CSP headers, it's automatically blocking certain XSS attacks.

Is it possible to configure the Content-Security-Policy to not block anything at all? I'm running a computer security class, and our web hacking project is running into issues on newer versions of Chrome because without any CSP headers, it's automatically blocking certain XSS attacks.

• javascript
• http-headers
• xss
• content-security-policy

Share Improve this question Follow edited May 26, 2023 at 20:14 General Grievance 4,9873737 gold badges3737 silver badges5454 bronze badges asked Mar 14, 2016 at 3:01 joshlfjoshlf 23.5k1414 gold badges7979 silver badges102102 bronze badges

Add a comment  | 

6 Answers 6

Sorted by: Reset to default 97

For people who still want an even more permissive posts, because the other answers were just not permissive enough, and they must work with google chrome for which * is just not enough:

default-src * data: mediastream: blob: filesystem: about: ws: wss: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline'; 
script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; 
script-src-elem * data: blob: 'unsafe-inline' 'unsafe-eval';
connect-src * data: blob: 'unsafe-inline'; 
img-src * data: blob: 'unsafe-inline'; 
media-src * data: blob: 'unsafe-inline'; 
frame-src * data: blob: ; 
style-src * data: blob: 'unsafe-inline';
font-src * data: blob: 'unsafe-inline';
frame-ancestors * data: blob:;

It's not secure at all, but as staring point the real allow all policy is:

default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';

See: https://content-security-policy.com/ and this CSP migration guide.

The best way would be not applying any policy.

But to answer your question, an "allow all policy" would probably be:

default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; 

Note: untested

Here's the htaccess code to allow everything in CSP

Header add Content-Security-Policy "default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval' 'unsafe-dynamic'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';"

DISCLAIMER/WARNING: Please consider writing a proper CSP. The following configuration allows any connection and does not provide any security benefit. The Content-Security-Policy-Report-Only header helps you to archive the goal of a proper CSP in two steps/non-blocking.

Since the default behavior is for every fetch directive to fall back to default-src (according to MDN), we only need to define a default-src and sources for all document and navigation directives (base-uri, form-action, form-ancestor). The simplest CSP header that allows anything should be this:

default-src * data: mediastream: blob: filesystem: about: ws: wss: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline';
base-uri * data: mediastream: blob: filesystem:;
form-action * data: mediastream: blob: filesystem:;
form-ancestor * data: mediastream: blob: filesystem:;

The explanation why * does not match "everything" is, that the asterix only allows all host-sources, but e.g. schema-sources, inline or eval are not host-sources. Therefore these types of sources must be explicitly specified.

EDIT: added directives that do not fallback to default-src (thanks for the comment)

In case anyone else needs an Object of @rainb's answer:

"csp": {
    "default-src": "* data: mediastream: blob: filesystem: about: ws: wss: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline';",
    "script-src": "* data: blob: 'unsafe-inline' 'unsafe-eval';",
    "script-src-elem": "* data: blob: 'unsafe-inline' 'unsafe-eval';",
    "connect-src": "* data: blob: 'unsafe-inline';",
    "img-src": "* data: blob: 'unsafe-inline';",
    "media-src": "* data: blob: 'unsafe-inline';",
    "frame-src": "* data: blob: ;",
    "style-src": "* data: blob: 'unsafe-inline';",
    "font-src": "* data: blob: 'unsafe-inline';",
    "frame-ancestors": " * data: blob:;"
}

本文标签： javascriptAllow All Content Security PolicyStack Overflow