How to write a CSP with wildcard?

user_5339295 0
Viewed 2359

I am writing a CSP for my website, the header is added via Lambda@Edge on AWS for my site on lightsail. I've got the CSP set as follows, been trying to get it to work: content-security-policy: default-src 'self' *.thetechcapsule.com thetechcapsule.com; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'

My domain is thetechcapsule.com and I have cloudfront CDN set up via www.thetechcapsule.com. I thought the wildcard would allow all subdomains but it's not working, getting script errors, but they should be using the default source?

E.g of error in console

Refused to load the script '<URL>' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Thanks

content-security-policy
1 Answers

Instead of 'self' the browser substitutes exact tuple: scheme+hostname+port with which page was loaded.

If you load page from Url http://example.com, the 'self' will be http://example.com and it does nol allow http://www.example.com.

If page is loaded as https://www.example.com, 'self' became https://www.example.com and it will not allow https://example.com or http://www.example.com (schemes are differs in last case).

Therefore, if your page loads resourses both from site.com and www.site.com, you need to do in the script-src directive exactly what you did in the default-src:

script-src 'self' *.thetechcapsule.com thetechcapsule.com;

May be the same will required for styles/images if you mix site.com and www.site.com for resource loading.

Note: In the CSP3-compatible browsers, the 'self' token additionally covers the ws: and wss: schemes. And http://example.com allows to be upgraded to https://example.com.

user_128659440
Related