Content security policy: malformed syntax
Summary: PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified through a response header or meta tag. The entry states that malformed syntax in a policy causes the browser to ignore the directive, and advises using correct syntax.
What's compelling: A CSP that a browser silently ignores because of a syntax error leaves the dangerous behaviors it was meant to block - untrusted JavaScript execution among them - fully available, with no visible failure to alert you.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026