CSP: Wildcard Directive Issue

[Philip Louis Calub]

Hello Good Day!.

I'm using the Docker Baseline Scan to scan my website.

I've added a add_header Content-Security-Policy "default-src 'self' "; in my nginx conf.

I'm still getting the CSP: Wildcard Directive.

Any ideas on how to solve the CSP: Wildcard Directive? 

[Simon Bennetts]

Can you run ZAP locally and give us an example of the alert with all of the alert information, including the response header?

Redacting any sensitive information of course.

The full alert details should give you much more useful information.

Cheers,

Simon

[Philip Louis Calub]

Here's the ZAP Result. Run in docker locally.

Thanks,

Philip

[kingthorin+owaspzap]

You're using a report that does not include the "Other Info" field. There are some CSP directive that DO NOT fall back to default-src therefore if you don't define them that's the same as using a wildcard directive.