Hi @RSingavarapu102525 (Community Member)​ ,

Typically CWE 829 flaws found in dynamic scans are due to lack of a Content Security Policy (CSP). Lack of CSP in itself isn't a security risk but using a strict CSP provides additional protection against certain type of attacks (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) . You can verify within the response header of your application whether CSP is used or not.

A couple CSP directive in particular that we advise on setting is the default-src and script-src . These will ensure that you're only allowing JavaScript that you have defined and trust. Other CSP directive like frame-ancestors might also be useful to set to prevent click-jacking and not allowing your site to be framed. Keep in mind that some browser don't support CSP or certain CSP directives. You'll need to make sure the CSP directives you're specifying will work correctly for your application.

I would recommend you schedule a consultation call to discuss this in more detail with a member of my team. We can discuss the specifics around the flaw found in your application and what the appropriate approach would be to remediate. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Thanks,

Boy Baukema