BPatel046592 (Community Member) asked a question.
I'd added Content security policy below but still complain about the XSS reflected and csp block the google analytics.
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<add name="X-Frame-Options" value="SAMEORIGIN" />
<add name="X-XSS-Protection" value="1; mode=block" />
<add name="X-Content-Type-Options" value="nosniff" />
<add name="Strict-Transport-Security" value="max-age=31536000;includeSubDomains" />
<add name="Cache-Control" value="no-store" />
<add name="Referrer-Policy" value="same-origin" />
<add name="Content-Security-Policy" value="base-uri 'self';
connect-src 'self' https://example.com 'unsafe-inline';
default-src 'self' 'unsafe-inline' 'unsafe-eval';
script-src-elem 'unsafe-inline' 'self' https://example.com/;
font-src 'self' https://fonts.gstatic.com; frame-src 'self';
img-src 'self' 'unsafe-inline';
manifest-src 'self';
media-src 'self';
style-src 'self' 'unsafe-inline'; style-src-elem 'self' https://fonts.googleapis.com 'unsafe-inline'" />
</customHeaders>
</httpProtocol>
examples:
http://example.com/(A(XYZ123))
http://example.com/(A(XYZ123))/Registration
http://example.com/(A(XYZ123))/ForgotPassword
http://example.com/(A(XYZ123))/Error/NotFound
http://example.com/(A(XYZ123))/Script.js
.png){kind=logo}
Hi @BPatel046592 (Community Member),
The reason this finding is still reported by Veracode Dynamic Analysis is the existence of the `unsafe-eval` and `unsafe-inline` directives. For `script-src` (which is the most important directive with respect to XSS), we would recommend the use of nonces or hashes as opposed to enabling `unsafe-inline`. Using nonces/hashes disables all inline JavaScript other than blocks that are explicitly specified to be allowed.
The following guide by Google describes this process for your scenario: https://developers.google.com/tag-manager/web/csp. Google recommends the use of a nonce, which should be unguessable, random, and individually generated for each response. They further state to then "use the nonce-aware version of the inline Google Tag Manager snippet, setting the nonce attribute on the inline script element to this same value".
Thank you,
Florian Walter