Add base-uri to the Content-Security-Policy
Why it matters
An injected base tag can make every relative script URL on the page load from an attacker's server. base-uri 'self' (or 'none') stops that and almost never breaks anything.
The fix
- Add base-uri 'self' to the policy ('none' if your pages have no base tag).
- If your pages use a base tag pointing at another origin, list that origin instead.
http
Content-Security-Policy: <your current policy>; base-uri 'self' Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.