A municipal web app has no Content-Security-Policy, or leaves CSP in report-only mode indefinitely. How should the tester describe CSP's role?
Select an answer to reveal the explanation.
Short Explanation
CSP is a seatbelt, not a promise you will never crash. Missing or forever-report-only policies leave XSS impact higher than it needs to be — still fix the bugs, but call out the missing belt. Report-only mode watches; it does not block.
Full Explanation
A municipal web app with no Content-Security-Policy, or CSP left in report-only mode indefinitely, lacks an important XSS defense-in-depth layer. A well-designed enforcing CSP can reduce XSS impact by constraining script sources; absence or perpetual report-only should be reported as a gap, not as a solved control.
CSP alone does not replace input validation or make XSS impossible forever. Report-only mode does not enforce blocking the way an enforcing policy does. Claiming CSP is irrelevant to XSS impact and should never appear in findings understates its role.
Exam caveat: weak CSPs with unsafe-inline everywhere provide little value; quality of policy matters as much as presence.
Operational check: fetch CSP headers on key civic pages, note enforcing versus report-only, and sample console/report endpoint noise if available. Recommend a staged path from report-only to enforcing policy tailored to the municipal front-end toolchain. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.