Frame Ancestors are allowed to have non-leading wildcards
Open
- Dominant language
- TypeScript
- Stars
- 404
- Forks
- 59
- PR merge metrics
- No merged PRs in 30d
Description
As described on MDN (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors#sources), any wildcards used in a source for the frame-ancestors directive must be leading. However, CSP Evaluator does not flag when a non-leading wildcard is used, and instead says it is all good:
Contributor guide
Assessment
This issue has not been assessed yet.