For a security review, I ran ZAP scanner on my application (Salesforce URL) and it is reflecting some security issues.

The description for CSP issue is as follows:

The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:

script-src, script-src-elem, script-src-attr, style-src, style-src-elem, style-src-attr, img-src, connect-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action

The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.

Please suggest a solution for this.

  • Hi @Badar You were able to resolve the above isse? Could you point to the solution on how it was fixed? Aug 5 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.