FINDING 01 / CONFIGURATION HARDENING
Content Security Policy not observed
Hardening observation · No exploitability claim · No CVSS assigned
What was observed
The illustrative response below omits the Content-Security-Policy header. That is a configuration observation. It does not establish that the application has an exploitable cross-site scripting vulnerability.
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
# Synthetic excerpt. Content-Security-Policy not present.Why it matters
An appropriate Content Security Policy can restrict browser resource loading and reduce the impact of some injection flaws. Its value depends on the application and the quality of the policy. It complements secure application design.
Coverage and limitations
This example covers a single anonymous response. Authenticated routes, other status codes, JavaScript execution, and application-specific exploitability were not assessed. A policy delivered elsewhere would require separate review.
Suggested remediation procedure
- Inventory required scripts, styles, images, frames, and network destinations for the affected application.
- Design a policy appropriate to the application. Avoid copying a generic allowlist or broadly permitting inline scripts.
- Deploy the proposed policy in
Content-Security-Policy-Report-Onlymode in a controlled test environment and review violations. - Test important user journeys, adjust permitted sources, then enforce the policy through the application or reverse proxy.
- Record the owner, affected routes, change reference, and rollout date in the finding record.
Proposed retest criteria
- The expected policy is present on the relevant response paths.
- Important user journeys work without unexplained policy violations.
- The policy restricts the intended resources and has been reviewed in application context.
- An analyst records the evidence and closure decision. A missing alert alone does not establish remediation.