This article is a part of our Web Security Knowledge Base (back to index)

Why CSP Scanner: Notices can be dangerous

Content Security Policy (CSP) adds a layer of security which helps to detect and mitigate certain types of attacks such as Cross Site Scripting (XSS) and data injection attacks. Hackers use XSS attacks to trick trusted websites into delivering malicious content. The browser executes all code from trusted origin and can’t differentiate between legitimate and malicious code, so any injected code is executed as well.

How to fix CSP Scanner: Notices

Review all the notices detected by ScanRepeat and ensure that your web server, application server, load balancer, etc. is properly configured to set the correct Content-Security-Policy header.

How does ScanRepeat report CSP Scanner: Notices

ScanRepeat analyzes every HTTP response ‘Content-Security-Policy’ header and checks its correctness against CSP specification. ScanRepeat notices every duplicate in the ‘Content-Security-Policy’ header and informs about any deprecated or experimental directives being used.

Would you like to test your application now against this problem? Sign up for our free trial

Scan Your Web App Now
Scan your application
for 14 days for free

No credit card is required. No commitment.

Sign Up Free