HTML5 meta tags: if you remove a security meta tag, does the browser update accordingly?

user_4749297 0
Viewed 1595

If I have a CSP meta tag (as opposed to using an HTTP header), like so:

<meta http-equiv="Content-Security-Policy" content="default-src https://cdn.example.net; child-src 'none'; object-src 'none'">

... and then I go into developer tools and remove that node, would the browser act as though it was never provided, or would the fact that it was added at all be persistent no matter what?

I'm asking because I want to know if I should use an HTTP header (which can't be modified), or if it's safe to just use this meta tag.

security html
2 Answers

It looks like this Content-Security-Policy meta tag is "protected", i.e. the browser remembers its value even when it is removed via dev tools.

You can simply try it with this simple example: index.html

<!DOCTYPE html>
<html lang="en">

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="Content-Security-Policy" content="default-src self;">

Then open dev tools and type in:

fetch('http://example.com')

You will see something like:

VM345:1 Refused to connect to 'http://example.com/' because it violates the following Content Security Policy directive: "default-src self 'mocky.io'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

Let's try it with removing that particular meta tag

document.querySelector("[http-equiv='Content-Security-Policy']").remove()
fetch('http://example.com')

You will still see the same error.

I tried it in the most recent versions of chrome and firefox. Maybe some least known browsers or lower versions will react differently. Unfortunately, I couldn't find more info about it but I don't see any particular reason for not using it.

user_55945390
Related