Insecure CSP Policies
Many Content Security Policies provide a false sense of security. Learn the common pitfalls that make policies easy to bypass.
The Wildcard Asterisk
Using * allows scripts to be loaded from any domain in the world, including malicious ones.
The Fix
Specify only the domains you trust, or use 'self' for your own domain.
Dangerous Example
script-src *Data and Blob URI Schemes
Attackers can inject malicious scripts directly into the HTML using data: URLs, bypassing domain-based filters.
The Fix
Avoid 'data:' for scripts. If needed for images, restrict it to 'img-src data:'.
Dangerous Example
script-src data: blob:Unsafe Inline Scripts
Allows any inline <script> tag to execute, which is the primary vector for XSS attacks.
The Fix
Use nonces (unique per request) or SHA-256 hashes for specific inline scripts.
Dangerous Example
script-src 'unsafe-inline'Unsafe Eval
Allows the use of eval() and similar functions, which can turn strings into executable code.
The Fix
Refactor code to avoid eval(). Modern frameworks like React/Vue don't need it.
Dangerous Example
script-src 'unsafe-eval'Broad CDN Whitelisting
Whitelisting a whole CDN allows an attacker to load any library hosted there, including versions with known vulnerabilities or those that can be used for bypasses (like AngularJS).
The Fix
Whitelist specific files or sub-paths, or use Subresource Integrity (SRI) hashes.
Dangerous Example
script-src https://cdnjs.cloudflare.comStop Guessing.
Start Monitoring.
CSP Radar automatically identifies these insecure patterns in your policy and suggests safe alternatives based on real-world violation data.