The policy does not restrict the base element (base-uri).

CSP_NO_BASE_URI · Severity: Info

• InfoCSP_NO_BASE_URI

  The policy does not restrict the base element (base-uri).

  base-uri does not fall back to default-src. Without it, injected markup can set a base element and make relative script URLs load from another host.

  Recommendation: Add base-uri 'self' or base-uri 'none'.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.
• Warning CSP_NO_OBJECT_SRC Plugin content (object and embed elements) is not restricted.
• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.

All findings