wtf( )unctionsystem design, drawn
← all problemsBrowser SecurityMedium

The nuclear option that left three doors open

The policy starts by denying every resource type and then re-allows exactly what the page needs. The reasoning is sound: deny everything, permit deliberately.

Three directives do not take part in that fallback at all. Absent, each one allows everything — so this policy leaves the page framable by anyone, lets an injected tag re-point every relative URL on it, and permits a form to post wherever it likes.

Add the three directives the catch-all does not cover.
Components — tap one, then tap a slot on the diagram
?Denying everything by default is not a deny-all. Three directives never inherit from it, and absent they permit anything.

Outside every boundary: The page, Any origin (a form posts here; FAILED: unrestricted), Anyone's iframe (FAILED: can embed you), An injected <base> (FAILED: re-points URLs), default-src 'none' (the catch-all rule), an empty slot for the who may frame you, an empty slot for the what may set the base, an empty slot for the where forms may post Connections: default-src 'none' controls The page — denies fetches (step 1) The page controls who may frame you (step 2) who may frame you must NOT reach Anyone's iframe — cannot embed you The page controls what may set the base (step 3) what may set the base must NOT reach An injected <base> — cannot re-point The page controls where forms may post (step 4) where forms may post must NOT reach Any origin — cannot post here

The page
Any origina form posts hereunrestricted
Anyone's iframecan embed you
An injected <base>re-points URLs
default-src 'none'the catch-all rule