Safety
CSP object-src vs Browser Plugins on Public Sites
January 28, 2023
CSP object-src vs browser plugins on public sites is a leftover plugin surface versus modern script policy. object-src limits URLs that may load in <object>, <embed>, and <applet>. Flash and Java-in-the-browser are gone from current Chrome, but default-src * still allows plugin-shaped fetches if you never set object-src. object-src 'none' is the usual first enforcing CSP directive alongside frame-ancestors and base-uri. It does not replace script-src, connect-src, or SRI. RoastMyOpsec reads CSP quality on the landing HTML. It does not score missing object-src as a standalone F, does not load plugin content, and does not exploit embeds.
The practical difference
script-src is JavaScript. object-src is plugin/embed plugins. iframe sandbox and frame-ancestors are framing. A PDF in <embed> is an object-src question on some browsers; prefer a first-party viewer or a download link.
If default-src is 'self' and you omit object-src, object-src falls back to default-src. If default-src is missing or *, set object-src 'none' explicitly.
How to choose a policy
Most marketing sites: object-src 'none' on day one. You must embed a PDF from your origin: object-src 'self' and still prefer <iframe> plus sandbox. You must load a vendor embed URL: name that origin, not *. Pair with Report-Only while you watch for blocked PDFs.
| Directive | Typical default | Does not replace | Takeaway |
|---|---|---|---|
| object-src 'none' | Brochure CSP | script-src | Ship it early |
| script-src nonce/hash | JS allowlist | object-src | See nonce vs hash |
| frame-ancestors | Who may iframe you | object-src | See CSP vs XFO |
| base-uri 'none' | No surprise <base> | object-src | See base-uri vs redirects |
What the roast can prove
CSP presence and quality signals on the HTML response can surface. A missing object-src is not always scored as its own finding. Confirm the directive in the header. Pair with connect-src if the embed also fetches APIs.
Common mistakes
The first mistake is default-src * and no object-src because 'nobody uses Flash.'
The second mistake is object-src https: for a single PDF host.
The third mistake is treating object-src as Trusted Types.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does object-src 'none' break YouTube iframes?
- Iframes are frame-src / child-src, not object-src. YouTube is a framing and script question.
- Should brochure sites set object-src 'none'?
- Yes as a default. Missing it is not always a roast F if default-src is already tight.
- Does RoastMyOpsec require object-src?
- It grades CSP quality overall. It does not load plugins or treat object-src as the only CSP check.