Remove wildcard sources from script-src on Cloudflare
Why it matters
A script-src that allows *, http:, https: or data: lets an attacker load a script from any server they control, so the policy does not stop script injection. List the exact hosts you use, or switch to nonces with 'strict-dynamic'.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: add a Response Header Transform Rule with Set static, header Content-Security-Policy-Report-Only and your policy with explicit hosts instead of the wildcard.
- Stage 2: when nothing legitimate is reported, put the same script-src into wherever the enforced policy is set (the rule or the origin) and delete the report-only rule.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.