Sobelow v0.6.9 Sobelow.Config.CSP

Missing Content-Security-Policy

Content-Security-Policy is an HTTP header that helps mitigate a number of attacks, including Cross-Site Scripting.

Read more about CSP here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Missing Content-Security-Policy is flagged by sobelow when a pipeline implements the :put_secure_browser_headers plug, but does not provide a Content-Security-Policy header in the custom headers map.

Documentation on the put_secure_browser_headers plug function can be found here: https://hexdocs.pm/phoenix/Phoenix.Controller.html#put_secure_browser_headers/2

Content-Security-Policy checks can be ignored with the following command:

$ mix sobelow -i Config.CSP

Summary

Functions

check_vuln_pipeline(pipeline, meta_file)
details()
run(router, _)