0

Does script-src parameter using hashes works for inline scripts only?

This config works for for me (inline script in HTML code):

Apache config:

Header set Content-Security-Policy-Report-Only: "script-src  'sha256-U82JgRvGjy4mzia+G8DutvX8V/W33LIoO2UuwT+rE/0='"

HTML code:

<!DOCTYPE html>
<html lang="en">

    <head>
        <meta charset="UTF-8">
        <title>Hello!</title>
    </head>

    <body>
        <h1>Hello World!</h1>
        <p>This is a simple paragraph.</p>
    </body>

    <script>alert('hello everybody')</script>

</html>

where: U82JgRvGjy4mzia+G8DutvX8V/W33LIoO2UuwT+rE/0= is a sha256 hash code of
alert('hello everybody') converted into base64

Once I moved the same script alert('hello everybody') into separate js file test.js and have updated index.html

<!DOCTYPE html>
<html lang="en">

    <head>
        <meta charset="UTF-8">
        <title>Hello!</title>
    </head>

    <body>
        <h1>Hello World!</h1>
        <p>This is a simple paragraph.</p>
    </body>

    <script src="test.js"></script>

</html>

CSP blocking test.js file, however hash for it still the same

[Report Only] Refused to load the script 'http://localhost/test.js' because it violates the following Content Security Policy directive: "script-src 'sha256-U82JgRvGjy4mzia+G8DutvX8V/W33LIoO2UuwT+rE/0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

What parameter should I use for CSP to allow local js file by hash?

jack
  • 1

1 Answers1

0

This should allow loading a script from the same source: "script-src 'self';"

Halvor Sakshaug
  • 2,583
  • 1
  • 6
  • 9
  • you are right, 'self' parameter allows to run all local scripts from the host. But I need to allow it by hash, to avoid script changes before running. – jack Aug 17 '22 at 08:21
  • You can do so in CSP level 3, see https://www.w3.org/TR/CSP3/#external-hash. But it may not have full browser support yet. This could also be done with Subresource Integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity – Halvor Sakshaug Aug 17 '22 at 09:50