I have a webpage (say origin=A) that has an iframe embedded in it which loads from a different domain (say B). B loads bunch scripts from different domains (various CDNs). My webpage A sets pretty strict CSP like:
default-src 'none'; script-src 'self'; frame-src B
B doesn't set any CSP headers.
Now I would expect the child frame, B, to inherit the CSP rules of A and trying to access various CDNs should be a violation of its CSP because of script-src 'self' but to my surprise, it works smoothly.
So my question is: How CSP is inherited by child iframes ? Does it depend on its parent frame's CSP if CSP for iframe is not mentioned ? If yes, how ? Is there any documentation somewhere about it, I couldn't find anything specific that would explain the situation above.
Is there a way I can debug the CSP inherited by child iframes ? From Chrome's debugger or FF's debugger - by selecting the iframe and then CSP for the iframe would show up ?
Yes, see the Policy applicability section of the CSP2 specification, which says this: Embedded Contexts: Any resource included via iframe , object , or embed .
An inline frame (iframe) is a HTML element that loads another HTML page within the document. It essentially puts another webpage within the parent page. They are commonly used for advertisements, embedded videos, web analytics and interactive content.
An id on an <iframe> tag assigns an identifier to the element. The identifier must be unique across the page.
How CSP is inherited by child iframes?
It’s not — not in the common case (the “loads from a different domain” case in the question).
But there are other ways to populate iframe
, and CSP works different for those (see below).
Does it depend on its parent frame's CSP if CSP for iframe is not mentioned?
No, it doesn’t for the common case (the “loads from a different domain” case in the question).
Is there any documentation somewhere about it
Yes, see the Policy applicability section of the CSP2 specification, which says this:
Embedded Contexts: Any resource included via
iframe
,object
, orembed
.Unless the embedded resource is a globally unique identifier (or a
srcdoc
iframe), the embedded resource is controlled by the policy delivered with the resource. If the embedded resource is a globally unique identifier orsrcdoc
iframe, it inherits the policy of the context creating it.
A “globally unique identifier” is something with a data:
URL or other kind of URL that’s not a hierarchical URL such an https
/http
URL.
So the common case (“loads from a different domain” in the question) is a “embedded resource is controlled by the policy delivered with the resource” case—that is, it doesn’t inherit.
In contrast, if the iframe
is a srcdoc
iframe, the case is very different and the spec says:
Whenever a user agent creates an
iframe srcdoc
document in a browsing context nested in the protected resource, if the user agent is enforcing any policies for the protected resource, the user agent MUST enforce those policies on theiframe srcdoc
document as well.
That is a srcdoc
iframe does inherit its parent’s CSP policy.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With