TWA 0219

TWA-0219

Message

"Content-Security-Policy missing"

Explanation

The Content-Security-Policy could be sent from the web server to the web browser in the HTTP response header. A stronger protection of the users data by the web browser could be activated with the Content-Security-Policy if it is supported by the web browser.

Remediation

Include a Content-Security-Policy setting in the web server configuration. Chooses the strongest directives possible for your web application.

See

• MDN web docs: Content Security Policy
• OWASP Content Security Policy Cheat Sheet