base-uri restricted

A missing base-uri directive lets an attacker who can inject a <base href='https://attacker.com'> tag redirect every relative URL on the page — scripts, stylesheets, form actions, and navigation links — to an attacker-controlled origin. Unlike XSS, this attack requires no JavaScript execution: injecting a single <base> tag is sufficient to compromise the entire page's resource resolution. CWE-79 and CWE-1021 (Improper Restriction of Rendered UI Layers) both apply. OWASP A03 categorizes base-tag injection as a client-side injection technique distinct from classic XSS.

Add base-uri 'self' or base-uri 'none' to your CSP. Unlike most directives, base-uri does not inherit from default-src — it must be specified explicitly.

Content-Security-Policy: default-src 'self'; base-uri 'self'; script-src 'nonce-{perRequest}' 'strict-dynamic'

If your application does not use any <base> tags (most don't), prefer base-uri 'none' for maximum restriction. Check grep -r '<base' src/ to confirm zero usage before setting 'none'.