In one paragraph
CSP object-src missing identifies a policy that does not meet this check's requirement to block object and embed loads. The effective restriction may come from object-src or its default-src fallback. Set object-src 'none' when those elements are unnecessary, then test document and media embeds. This directive does not block ordinary images, video elements, scripts, or iframes by itself.
Why it matters
The object and embed elements can load resources such as documents and PDFs. Although legacy browser plugins are largely gone from mainstream browsing, the elements remain part of the platform. Restricting unused loading mechanisms reduces the possibilities available after a markup injection.
Keep the risk description proportionate. A missing object-src is not proof that Flash or Java plugins are active, nor does every object create script execution on the embedding origin. Relevant behaviour depends on the loaded format, origin, browser, and other controls.
The effective directive also matters. When object-src is absent, default-src can supply its fallback. default-src 'none' can therefore block these loads already. default-src 'self' still permits same-origin resources, including potentially untrusted content if your upload architecture exposes it there.
How WebAuditOS evaluates this finding
The supplied rule parses enforcing CSP headers and checks object-src, falling back to default-src. If at least one policy has an effective source list exactly equal to 'none', it passes. Otherwise it warns. No enforcing CSP or non-HTML responses are not graded.
Report-only and meta policies are not read by this check. A bare empty object-src can block in a browser but is not recognised as the documented passing form. The checker also does not accept 'none' mixed with other sources. Use the unambiguous standalone keyword rather than relying on edge-case syntax.
How to fix it
- Read all enforcing policies on the final HTML response. Work out the effective object source restriction, including default-src fallback and cumulative policies. Do not add an unnecessary second policy without understanding the current one.
- Search served and rendered markup for object and embed elements. Include stored CMS content, old media widgets, PDF brochures, and account reporting screens. A homepage without an embed does not establish that no route uses one.
- If those loads are unnecessary, add this directive to the existing policy:
Content-Security-Policy: object-src 'none'The line demonstrates one directive, not a complete policy to replace your existing protections. Keep the quotes around 'none'; an unquoted word is not the same CSP keyword.
- If a legitimate embed exists, decide whether to replace it, keep a scoped allowance, or accept the informational warning with a documented reason. Do not claim the only secure application is one that cannot show documents.
- Consider a normal link, an iframe governed by frame-src, or a reviewed document-viewing component where appropriate. Each alternative has its own security and accessibility implications. Moving an unsafe document into an iframe is not automatically a complete isolation strategy.
- Test the candidate policy in report-only mode and exercise embedded content. Then enforce it and inspect Console violations and Network behaviour. A blocked PDF area may remain blank while every server request otherwise appears healthy.
- In staging, confirm that an object or embed load you intend to block is actually blocked. Also verify ordinary media and iframe features still operate under their separate directives.
- Rescan in WebAuditOS and retain evidence of any intentional exceptions. If files are user-controlled, review upload validation, authorisation, origin separation, and content handling independently of this CSP setting.
What the fix can break
PDF displays built using object or embed are the most likely legitimate casualty. Offer a working accessible alternative and test mobile behaviour before removing the existing viewer.
Old third-party media markup can also depend on these elements. Determine whether the integration still serves a useful supported function rather than preserving obsolete allowances without an owner.
Broadening default-src merely to restore an object can affect many other resource types. Use the appropriate specific directive or replace the dependency. Do not weaken the whole policy because one report document needs different handling.
Questions
Does object-src 'none' block iframes?
No. iframe loading is governed by other applicable directives, usually frame-src with its fallback rules. It must be reviewed separately.
Can default-src 'none' already satisfy this finding?
Yes, when object-src is absent and the effective fallback is exactly 'none', the supplied rule recognises the block.
Why is self not the same as none?
'self' allows same-origin object resources. 'none' blocks the category. Their difference matters when same-origin files can contain untrusted data.
Which related checks help?
Review base-uri, default-src, and the security headers guide.