OWASP/owasp.github.io

The number of URLs is increasing for 'CSP: script-src unsafe-inline' and 'CSP: style-src unsafe-inline' after fixing 'CSP: Wildcard Directive'

Opened this issue · 0 comments

Hello.

  1. I has the next report:
    image
    The value of CSP was
    "default-src 'self'; script-src 'self' cdn.jsdelivr.net 'unsafe-inline'; img-src 'self' validator.swagger.io bootswatch.com getbootstrap.com data:; style-src 'self' cdn.jsdelivr.net 'unsafe-inline'; font-src 'self' cdn.jsdelivr.net data:; connect-src 'self' bootswatch.com;"
  2. I fixed CSP: Wildcard Directive by adding form-action 'self'; frame-ancestors 'self' and received the next report:
    image
  3. My question is why the number of URLs in CSP: script-src unsafe-inline and CSP: style-src unsafe-inline was increased?