New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSP in <meta> is not analyzed when sent together with CSP in header #489

Open

rw-AntoniRoszak opened this issue Nov 14, 2022 · 0 comments

rw-AntoniRoszak commented Nov 14, 2022 •

edited

Steps:

Scan page: https://shop.rockwool.com

Observation:

Page scores 120 with most CSP directives listed as "none".

Expectation:

Page should score 110, as there are more directives in tag. They are analyzed by code, but discarded.

Problem appeared in commit a422b3a - when I check out master before this commit, the combined policy is analyzed properly.

CSP header data:
upgrade-insecure-requests; frame-ancestors 'self'

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment