Collected research

Neatly bypassing CSP

Neatly bypassing CSP ✔️

@bo0om · Wallarm · 10 July 2018

A page with a strict CSP can still be attacked by framing a same-origin path that returns no CSP header, such as a CSS file, robots.txt or a server error page, because browsers wrap those responses in HTML. Script written into that frame runs unrestricted and can read the parent page; oversized URLs or cookies are used to force the error responses.

Record

Document

Neatly bypassing CSP ✔️

Researcher

@bo0om

Published by

Wallarm

Date

10 July 2018

Topic

XSS

In the archive

• Collected in the 2018 research round

Tags

• csp
• filter-bypass
• xss
• iframe
• sop-bypass
• same-origin-policy
• http
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of @bo0om, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.