Missing object-src in CSP Declaration

Severity: Information
Summary#

Invicti detected that object-src is missed in CSP declaration. It allows the injection of plugins which can execute JavaScript.

Remediation#

Set object-src to 'none' in CSP declaration:

Content-Security-Policy: object-src 'none';

Classifications#
Invicti Logo

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo