Description

Detects the use of the deprecated 'block-all-mixed-content' directive in Content Security Policy headers. This directive is obsolete since modern browsers block mixed content by default, making its use unnecessary and potentially indicating outdated security configurations.

Detection Strategy

• Examines HTTP response headers for Content-Security-Policy (CSP) headers

• Checks if the CSP header contains the deprecated 'block-all-mixed-content' directive

• Reports a vulnerability when the deprecated directive is found, as it indicates outdated security configuration