CSP Auditor
Summary: CSP Auditor is a Burp Suite extension by Philippe Arteau of GoSecure, version 2.0a, last updated 11 February 2022, that gives a readable view of CSP headers for responses. It also includes passive scan rules to detect weak CSP configurations, and PortSwigger notes it is written by a third party and makes no warranty about its quality or usefulness.
Why it matters: A weak Content Security Policy is the difference between an injected script running in a user's browser and being blocked, and this extension's passive scan rules surface those weak configurations during testing. The tool is third-party code last updated in February 2022, so a security leader should weigh its age and lack of vendor warranty before relying on it in an assessment program.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026