CSP policy Injection, no option to disable.

  • frankpanduh

    (@frankpanduh)


    7 months, 2 weeks ago

    Fair warning to save you a headache, this plugin injects a CSP policy that will break your main policy.
    Don’t use this till they add a disable CSP mode.

    grep -R “Content-Security-Policy” wp-content/plugins/

    wp-content/plugins/multidots-passkey-login/multidots-passkey-login.php:                header(“Content-Security-Policy: $csp”);

    wp-content/plugins/multidots-passkey-login/multidots-passkey-login.php:                header(“Content-Security-Policy: $csp”);

Viewing 1 replies (of 1 total)
  • Plugin Support Pooja Bhimani

    (@poojabhimani)

    7 months, 2 weeks ago

    Thank you for bringing this to our attention and for sharing your findings.

    The plugin adds its own Content-Security-Policy header as part of its security implementation for passkey login. Depending on how headers are handled in a given environment, this can conflict with CSP rules defined by the server or other security plugins and may result in blocked resources.

    Currently, the plugin does not offer a setting to disable or customize the CSP header. We understand this limitation may affect sites that already enforce a custom CSP policy.

    This feedback has been shared with our development team and will be considered for future improvements.

    Thank you again for the constructive feedback.

Viewing 1 replies (of 1 total)

The topic ‘CSP policy Injection, no option to disable.’ is closed to new replies.