During a recent OWASP ZAP scan, medium-risk configuration issues were identified in the HTTP Content-Security-Policy (CSP) for the FreeIPA WebUI.

The CSP header is overly permissive due to the absence of several key directives and the lack of a default-src directive.
Since default-src is not defined, and directives like script-src, style-src, img-src, and others are missing, the policy effectively allows content from all sources (* for each missing directive). This significantly increases the risk of Cross-Site Scripting (XSS) attacks and other content injection attacks.

CWE: CWE-693: Protection Mechanism Failure

Recommendations:
- Define a restrictive default-src (e.g., self) and then explicitly whitelist all necessary external and internal sources for each required directive.
- script-src and style-src: these directives must be implemented without the 'unsafe-inline' source keyword. Inline scripts and styles should be enabled instead using cryptographic nonces or hashes. This approach ensures that only specifically whitelisted inline code is executed, effectively blocking malicious injections.