Loading...
Loading...
When script-src does not exist, FPS creates the script-src directive while ignoring the policy defined by default-src. This is also true for other directives such as img-src, style-src, etc.
Application might not work because of FPS restricting inline script execution.
Content-Security-Policy configured as follows: Content-Security-Policy: default-src 'unsafe-inline' For example, for the following header: default-src 'unsafe-inline' FPS modifies it to: default-src 'unsafe-inline'; script-src 'self' 'nonce-RANDOM-VAL'
None.
The 'unsafe-inline' will not be injected into script-src or style-src directives if it is present in default-src directive.
Click on a version to see all relevant bugs
F5 Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.