probeo

How to secure object-src in Content Security Policy?

csp-object-src-weak global

The issue

A policy that doesn’t restrict object-src lets <object> and <embed> elements load content from any origin. That content is governed by object-src, not script-src, so a strict script policy doesn’t cover it. Plugins such as Flash are gone from current browsers, which keeps the practical risk low, but the route stays open for no benefit.

The cause is that object-src isn’t set, and default-src either isn’t set or is too broad to restrict it.

Scope

The directive applies to every <object> and <embed> element in the document that receives the policy. It is normally set once, in the shared policy.

How to check you have it

  • In probeo: a policy in which neither object-src nor default-src is set is reported as csp:missing-object-src, graded minor. A default-src that is set counts as a restriction.
  • By hand: run curl -sI https://your-site.example/ | grep -i content-security-policy and look for object-src. If it is absent, read default-src, which is what applies instead.
  • With a tool: Google’s CSP Evaluator flags a policy with no object-src.

The fix

Add object-src 'none' to the Content Security Policy.

If the site deliberately embeds content with <object> or <embed>, such as a PDF viewer, list that content’s origin instead of 'none'. Setting the directive explicitly means a later change to default-src can’t loosen it by accident.

Done when: the policy sets object-src to 'none' or to named origins, and the check above comes back clean.

Do not

  • Do not use a wildcard in object-src.
  • Do not count on default-src to cover it if default-src may be widened later.
  • Do not add data: or blob: to object-src.

FAQ

Are plugins still a real threat if browsers have dropped Flash support?

Much less than they were. Current browsers no longer run Flash or Java applets, so the old attacks are largely gone. object-src 'none' still costs nothing on most sites and removes the route entirely.

What is the difference between missing object-src and wildcard object-src?

A missing object-src falls back to default-src, so it is only as safe as default-src is. A wildcard explicitly allows every origin.

Does object-src ‘none’ break embedded PDFs?

Only PDFs embedded with <object> or <embed>. A PDF in an <iframe> falls under frame-src, and a plain link isn’t affected at all. Look for <object> and <embed> on the site before enforcing.

Why not just rely on default-src to cover object-src?

It works while default-src stays strict. Widening default-src for another reason would quietly widen object-src too, and an explicit object-src 'none' doesn’t move.

Can object-src be deployed with report-only first?

Yes. A report-only policy with object-src 'none' shows any <object> or <embed> that would be blocked, without blocking it.

How does object-src interact with other CSP directives?

It stands on its own. Content loaded through <object> or <embed> is checked against object-src, not script-src, which is why it needs its own restriction.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.