title: CSP Scanner: Wildcard Directive alert for OpenID Connect session management endpoint
body: <p>We used ZAP 2.8 to scan our angular web application implemented with IdentityServer4 (implicit flow).</p>
  
  <p>It generated a Wildcard Directive alert (show in below), I am not sure it is a security issue or not. </p>
  
  <p>If it is a security issue, what should we do?  The OpenID Connect session management endpoint is not part of our app, it is IdentityServer4 build-in functionality. any suggestions? thanks</p>
  
  <hr>
  
  <p>Medium (Medium) CSP Scanner: Wildcard Directive
  Description 
  The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:frame-ancestor</p>
  
  <p>URL <a href="https://server103.abc.com:54231/services.identity/connect/checksession" rel="nofollow noreferrer">https://server103.abc.com:54231/services.identity/connect/checksession</a></p>
  
  <p>Method  GET</p>
  
  <p>Parameter   Content-Security-Policy</p>
  
  <p>Evidence    default-src 'none'; script-src 'sha256-ZT3q7lL9GXNGhPTB1Vvrvds2xw/kOV0zoeok2tiV23I='</p>