✔ CSP against the HTTP response serving it.

[righettod]

👨‍🎓 Learning of the day for me:

It seems, unless I missed a subtlety, that a CSP cannot be used to act on the capabilities of a loaded JavaScript script when the CSP is applied on the script itself, via the HTTP response that sends it.

📺 My test on Chromium 124.0.6320.0 (Developer Build) (64-bit):

https://youtu.be/r_HZJ2lT2SE

📡 @riramar and the community: Do you have any insights about such behavior?

[righettod]

🤔 CSP seems applied for the other CSP directive, like, the frame-ancestors one:

🤔 Other directives:

[righettod]

💡 So the key point I noticed was to apply a CSP on the page loading "unsafe" / "untrusted" resources:

[riramar]

Seems strange to me, but I'm not sure if this works as intended.
Sent this question in this group https://lists.w3.org/Archives/Public/public-webappsec/.

[righettod]

📚 Thanks a lot for the feedback and for the question. I added the direct ref below:

https://lists.w3.org/Archives/Public/public-webappsec/2024Feb/0006.html

[noamr]

Yes, Content-Security-Policy is a header that applies to a document, not to a sub-resource like a script. This is how it designed...

[righettod]

Thank you very much for your help on this matter 👍