← All tests

De-AMP CSP Sandbox: Landed on canonical URL

NAVIGATED You were force-navigated here from a page served with Content-Security-Policy: sandbox.

This is the canonical URL from that page's <link rel="canonical">. In the real threat model it is an attacker-controlled destination. The sandbox directive should have prevented the source page from navigating the top frame, but De-AMP performed the redirect without consulting CSP.

What happened

  1. You opened /de-amp/csp-sandbox/sandbox-amp, served with Content-Security-Policy: sandbox and AMP markup.
  2. De-AMP sniffed the body, found the AMP attribute and canonical link, and redirected the top frame here, ignoring the sandbox directive.

Back to the test page