# Cybersecurity Issue: Security Header settings insecure (OWASP A05:2021 Security Misconfiguration)
**URL:** https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006
**Category:** Report a Bug
**Tags:** security
**Created:** [August 25, 2025, 10:56am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006 "2025-08-25T10:56:23Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Samuel.Chou.OM](https://community.glideapps.com/u/Samuel.Chou.OM)
#### Post date: [August 25, 2025, 10:56am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/1 "2025-08-25T10:56:23Z")
I believe it’s a general issue.
* * *
**Description**
As our client requested, we ran a Vulnerability Assessment, targeting the web-admin and web-client side.
The result shows that Glide Apps has multiple medium-risk issues; one of them is OWASP A05:2021 Security Misconfiguration, caused by insecure CSP (content-security-policy) setting.,
**How to replicate**
1. Open any of your Glide App web-client or web-admin page.
2. Navigate to the Internet requests. For example, in Google Chrome, open DevTools \> Internet.
3. Navigate to any request that goes to [GET] `https://your-app.glide.page` with param `/?reqid=YourToken` ; or `justAtoken` sent from `document`
4. Look up to request header.
You will find that header filled with
| `content-security-policy default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'` |
| --- |
| |
, like:
**Fix Suggestion**
According to our cybersecurity partner, it is suggested that below changes should fix this:
1. rewrite it as `content-security-policy：default-src ‘none’;`
2. or just avoid using `‘unsafe-inline’` params
---
### Author:  [@MaximeBaker](https://community.glideapps.com/u/MaximeBaker)
#### Post date: [August 25, 2025, 11:00am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/2 "2025-08-25T11:00:14Z")
@comm_support_agent
@Samuel.Chou.OM next time, you can use the support chat for that 🙂
---
### Author:  [@Jeff\_Hager](https://community.glideapps.com/u/Jeff_Hager)
#### Post date: [August 25, 2025, 11:36am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/3 "2025-08-25T11:36:00Z")
I will repeat what you were told back in April.
> The forum isn’t the right place for this. Please report any suspected vulnerabilities to the team directly via security[at][glideapps.com](http://glideapps.com)
This is a user to user forum. We can’t help you with things like this. Contacting Glide directly is the better option.
---
### Author:  [@Samuel.Chou.OM](https://community.glideapps.com/u/Samuel.Chou.OM)
#### Post date: [August 26, 2025, 2:23am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/4 "2025-08-26T02:23:02Z")
Oh……I apologize for my misunderstanding. Thought it’d be good to raise issue here. Next time I will try using support chat. Thanks!
(Also I didn’t see any replies in April. I’ll double-check it. Thanks for mention!)
---
### Author:  [@Jeff\_Hager](https://community.glideapps.com/u/Jeff_Hager)
#### Post date: [August 26, 2025, 5:06am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/5 "2025-08-26T05:06:12Z")
You can send your concerns to the email address listed above.
---
### Author:  [@system](https://community.glideapps.com/u/system)
#### Post date: [September 2, 2025, 5:06am UTC](https://community.glideapps.com/t/cybersecurity-issue-security-header-settings-insecure-owasp-a05-2021-security-misconfiguration/84006/6 "2025-09-02T05:06:24Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.