Description

Detects when a web application is missing the Content Security Policy (CSP) HTTP header. Content Security Policy is a critical security control that helps prevent Cross-Site Scripting (XSS) and other injection attacks by specifying which content sources the browser should trust.

Detection Strategy

• Examines HTTP response headers for each page request

• Reports a vulnerability when the Content-Security-Policy header is completely missing from the HTTP response

• Triggers regardless of other security headers that may be present, as CSP provides unique protections