",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001812
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001745
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001705
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001683
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001661
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001639
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001617
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001603
},
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"score": 0.001581
}
]
},
"guidanceLevel": 2
},
"long-tasks": {
"id": "long-tasks",
"title": "Avoid long main-thread tasks",
"description": "Lists the longest tasks on the main thread, useful for identifying worst contributors to input delay. [Learn how to avoid long main-thread tasks](https://web.dev/articles/optimize-long-tasks)",
"score": 1,
"scoreDisplayMode": "informative",
"displayValue": "7 long tasks found",
"metricSavings": {
"TBT": 250
},
"details": {
"type": "table",
"headings": [
{
"key": "url",
"valueType": "url",
"label": "URL"
},
{
"key": "startTime",
"valueType": "ms",
"granularity": 1,
"label": "Start Time"
},
{
"key": "duration",
"valueType": "ms",
"granularity": 1,
"label": "Duration"
}
],
"items": [
{
"url": "https://www.morganstanley.com/akam/13/7136a5a1",
"duration": 386,
"startTime": 10943.711959999999
},
{
"url": "https://assets.adobedtm.com/b124caa02ab9/91dad913c75c/launch-f637afe91476.min.js",
"duration": 229,
"startTime": 4257.91867
},
{
"url": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/202601.2.0/otBannerSdk.js",
"duration": 144,
"startTime": 11395.711959999999
},
{
"url": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/202601.2.0/otBannerSdk.js",
"duration": 90,
"startTime": 10853.711959999999
},
{
"url": "https://www.morganstanley.com/etc.clientlibs/msdotcomr4/clientlibs/clientlibs-base.min.e1c50eb528a3172597d4e5cbf064ed3b.js",
"duration": 81,
"startTime": 5596.59331
},
{
"url": "https://www.morganstanley.com/etc.clientlibs/clientlibs/granite/jquery.min.3e24d4d067ac58228b5004abb50344ef.js",
"duration": 66,
"startTime": 5145.98314
},
{
"url": "Unattributable",
"duration": 66,
"startTime": 11329.711959999999
}
],
"sortedBy": [
"duration"
],
"skipSumming": [
"startTime"
],
"debugData": {
"type": "debugdata",
"urls": [
"https://www.morganstanley.com/akam/13/7136a5a1",
"https://assets.adobedtm.com/b124caa02ab9/91dad913c75c/launch-f637afe91476.min.js",
"https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/202601.2.0/otBannerSdk.js",
"https://www.morganstanley.com/etc.clientlibs/msdotcomr4/clientlibs/clientlibs-base.min.e1c50eb528a3172597d4e5cbf064ed3b.js",
"https://www.morganstanley.com/etc.clientlibs/clientlibs/granite/jquery.min.3e24d4d067ac58228b5004abb50344ef.js",
"Unattributable"
],
"tasks": [
{
"urlIndex": 0,
"startTime": 10943.7,
"duration": 386,
"other": 386,
"scriptEvaluation": 0
},
{
"urlIndex": 1,
"startTime": 4257.9,
"duration": 229,
"other": 229,
"scriptEvaluation": 0
},
{
"urlIndex": 2,
"startTime": 11395.7,
"duration": 144,
"other": 144,
"scriptEvaluation": 0
},
{
"urlIndex": 2,
"startTime": 10853.7,
"duration": 90,
"other": 90,
"scriptEvaluation": 0
},
{
"urlIndex": 3,
"startTime": 5596.6,
"duration": 81,
"other": 81,
"scriptEvaluation": 0
},
{
"urlIndex": 4,
"startTime": 5146,
"duration": 66,
"other": 66,
"scriptEvaluation": 0
},
{
"urlIndex": 5,
"startTime": 11329.7,
"duration": 66,
"other": 66,
"scriptEvaluation": 0
}
]
}
},
"guidanceLevel": 1
},
"non-composited-animations": {
"id": "non-composited-animations",
"title": "Avoid non-composited animations",
"description": "Animations which are not composited can be janky and increase CLS. [Learn how to avoid non-composited animations](https://developer.chrome.com/docs/lighthouse/performance/non-composited-animations/)",
"score": 1,
"scoreDisplayMode": "informative",
"displayValue": "1 animated element found",
"metricSavings": {
"CLS": 0
},
"details": {
"type": "table",
"headings": [
{
"key": "node",
"valueType": "node",
"subItemsHeading": {
"key": "failureReason",
"valueType": "text"
},
"label": "Element"
},
{
"key": null,
"valueType": "text",
"subItemsHeading": {
"key": "animation",
"valueType": "text"
},
"label": "Name"
}
],
"items": [
{
"node": {
"type": "node",
"lhId": "page-16-DIV",
"path": "1,HTML,1,BODY,5,DIV,1,DIV",
"selector": "body.page > div#onetrust-consent-sdk > div#onetrust-banner-sdk",
"boundingRect": {
"top": 397,
"bottom": 823,
"left": 0,
"right": 412,
"width": 412,
"height": 426
},
"snippet": "
",
"nodeLabel": "We and our partners use cookies and similar tools (“Cookies”) as necessary to p…"
},
"subItems": {
"type": "subitems",
"items": [
{
"failureReason": "Unsupported CSS Property: bottom",
"animation": "slide-down-custom"
}
]
}
}
]
},
"guidanceLevel": 2
},
"unsized-images": {
"id": "unsized-images",
"title": "Image elements do not have explicit `width` and `height`",
"description": "Set an explicit width and height on image elements to reduce layout shifts and improve CLS. [Learn how to set image dimensions](https://web.dev/articles/optimize-cls#images_without_dimensions)",
"score": 0.5,
"scoreDisplayMode": "metricSavings",
"metricSavings": {
"CLS": 0
},
"details": {
"type": "table",
"headings": [
{
"key": "node",
"valueType": "node",
"label": ""
},
{
"key": "url",
"valueType": "url",
"label": "URL"
}
],
"items": [
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/en/blueprint/WWD-Background-HP.jpg/_jcr_content/renditions/wwd_9x16.jpg",
"node": {
"type": "node",
"lhId": "1-302-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,1,MAIN,0,DIV,0,DIV,1,DIV,2,DIV,0,DIV,0,DIV,0,DIV,3,DIV,0,DIV,0,PICTURE,3,IMG",
"selector": "div.cmp-teaser__image > div.cmp-image > picture > img.cmp-image__image",
"boundingRect": {
"top": 714,
"bottom": 1289,
"left": 6,
"right": 328,
"width": 322,
"height": 575
},
"snippet": "![\"\"](\"https://www.morganstanley.com/content/dam/msdotcom/en/blueprint/WWD-Backgr…\")
",
"nodeLabel": "div.cmp-teaser__image > div.cmp-image > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/en/blueprint/wide-Blueprint-promo.png/_jcr_content/renditions/wide_16x9.png",
"node": {
"type": "node",
"lhId": "1-311-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,1,MAIN,0,DIV,0,DIV,2,DIV,2,DIV,0,DIV,0,DIV,1,DIV,0,PICTURE,3,IMG",
"selector": "div.basic-breaker-grid > div.basic-breaker-grid__media > picture > img.cmp-image__image",
"boundingRect": {
"top": 1593,
"bottom": 1802,
"left": 20,
"right": 392,
"width": 372,
"height": 209
},
"snippet": "![\"\"](\"/content/dam/msdotcom/en/blueprint/wide-Blueprint-promo.png/_jcr_content/r…\")
",
"nodeLabel": "div.basic-breaker-grid > div.basic-breaker-grid__media > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/Insights/institute/wide-institute-v3.jpg/_jcr_content/renditions/extrawide_3x1.jpg",
"node": {
"type": "node",
"lhId": "1-324-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,1,MAIN,0,DIV,0,DIV,5,DIV,0,DIV,2,DIV,0,DIV,0,PICTURE,2,IMG",
"selector": "div.ms-container > div.newsletter-subscribe--image > picture > img.cmp-image__image",
"boundingRect": {
"top": 2329,
"bottom": 2459,
"left": 0,
"right": 412,
"width": 412,
"height": 130
},
"snippet": "![\"\"](\"https://www.morganstanley.com/content/dam/msdotcom/Insights/institute/wide…\")
",
"nodeLabel": "div.ms-container > div.newsletter-subscribe--image > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/people/profile-hero/hero-Mona-Eldam.jpg/_jcr_content/renditions/wide_16x9.jpg",
"node": {
"type": "node",
"lhId": "1-328-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,1,MAIN,0,DIV,0,DIV,7,DIV,0,DIV,2,DIV,0,DIV,4,DIV,2,DIV,1,DIV,0,DIV,0,DIV,0,DIV,1,DIV,0,PICTURE,3,IMG",
"selector": "div.cmp-pullquote__content > div.cmp-pullquote__image > picture > img.cmp-image__image",
"boundingRect": {
"top": 3926,
"bottom": 4026,
"left": 79,
"right": 258,
"width": 179,
"height": 100
},
"snippet": "![\"\"](\"/content/dam/msdotcom/people/profile-hero/hero-Mona-Eldam.jpg/_jcr_content…\")
",
"nodeLabel": "div.cmp-pullquote__content > div.cmp-pullquote__image > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/footer-icons/privacyoptions29x14.jpg",
"node": {
"type": "node",
"lhId": "1-2-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,2,DIV,0,DIV,1,DIV,0,DIV,0,DIV,0,DIV,0,DIV,0,DIV,0,FOOTER,4,SECTION,0,DIV,0,NAV,0,UL,6,LI,0,A,1,IMG",
"selector": "ul.cmp-navigation__group > li.cmp-navigation__item > a.cmp-navigation__item-link > img.cmp_footernav_icon_image",
"boundingRect": {
"top": 5875,
"bottom": 5889,
"left": 304,
"right": 334,
"width": 30,
"height": 14
},
"snippet": "![\"Your](\"/content/dam/msdotcom/footer-icons/privacyoptions29x14.jpg\")
",
"nodeLabel": "Your Privacy Choices"
}
}
]
},
"guidanceLevel": 4
},
"valid-source-maps": {
"id": "valid-source-maps",
"title": "Missing source maps for large first-party JavaScript",
"description": "Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. [Learn more about source maps](https://developer.chrome.com/docs/devtools/javascript/source-maps/).",
"score": 0,
"scoreDisplayMode": "binary",
"details": {
"type": "table",
"headings": [
{
"key": "scriptUrl",
"valueType": "url",
"subItemsHeading": {
"key": "error"
},
"label": "URL"
},
{
"key": "sourceMapUrl",
"valueType": "url",
"label": "Map URL"
}
],
"items": [
{
"scriptUrl": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/202601.2.0/otBannerSdk.js",
"subItems": {
"type": "subitems",
"items": [
{
"error": "Large JavaScript file is missing a source map"
}
]
}
}
]
}
},
"csp-xss": {
"id": "csp-xss",
"title": "Ensure CSP is effective against XSS attacks",
"description": "A strong Content Security Policy (CSP) significantly reduces the risk of cross-site scripting (XSS) attacks. [Learn how to use a CSP to prevent XSS](https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"severity": "Medium",
"description": "The page contains a CSP defined in a `` tag. Consider moving the CSP to an HTTP header or defining another strict CSP in an HTTP header."
}
]
}
},
"has-hsts": {
"id": "has-hsts",
"title": "Use a strong HSTS policy",
"description": "Deployment of the HSTS header significantly reduces the risk of downgrading HTTP connections and eavesdropping attacks. A rollout in stages, starting with a low max-age is recommended. [Learn more about using a strong HSTS policy.](https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"directive": "includeSubDomains",
"description": "No `includeSubDomains` directive found",
"severity": "Medium"
},
{
"directive": "preload",
"description": "No `preload` directive found",
"severity": "Medium"
}
]
}
},
"origin-isolation": {
"id": "origin-isolation",
"title": "Ensure proper origin isolation with COOP",
"description": "The Cross-Origin-Opener-Policy (COOP) can be used to isolate the top-level window from other documents such as pop-ups. [Learn more about deploying the COOP header.](https://web.dev/articles/why-coop-coep#coop)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"description": "No COOP header found",
"severity": "High"
}
]
}
},
"clickjacking-mitigation": {
"id": "clickjacking-mitigation",
"title": "Mitigate clickjacking with XFO or CSP",
"description": "The `X-Frame-Options` (XFO) header or the `frame-ancestors` directive in the `Content-Security-Policy` (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. [Learn more about mitigating clickjacking](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation).",
"score": null,
"scoreDisplayMode": "notApplicable",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": []
}
},
"trusted-types-xss": {
"id": "trusted-types-xss",
"title": "Mitigate DOM-based XSS with Trusted Types",
"description": "The `require-trusted-types-for` directive in the `Content-Security-Policy` (CSP) header instructs user agents to control the data passed to DOM XSS sink functions. [Learn more about mitigating DOM-based XSS with Trusted Types](https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss).",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"severity": "High",
"description": "No `Content-Security-Policy` header with Trusted Types directive found"
}
]
}
},
"script-treemap-data": {
"id": "script-treemap-data",
"title": "Script Treemap Data",
"description": "Used for treemap app",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "treemap-data",
"nodes": [
{
"name": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/otSDKStub.js",
"resourceBytes": 26546,
"encodedBytes": 8727,
"unusedBytes": 7312
},
{
"name": "https://www.morganstanley.com/",
"resourceBytes": 1426,
"encodedBytes": 186,
"children": [
{
"name": "(inline) function Optano…",
"resourceBytes": 28,
"unusedBytes": 0
},
{
"name": "(inline) var MSCOM = MSC…",
"resourceBytes": 809,
"unusedBytes": 0
},
{
"name": "(inline)
",
"nodeLabel": "div.basic-breaker-grid > div.basic-breaker-grid__media > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/Insights/institute/wide-institute-v3.jpg/_jcr_content/renditions/extrawide_3x1.jpg",
"node": {
"type": "node",
"lhId": "1-324-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,1,MAIN,0,DIV,0,DIV,5,DIV,0,DIV,2,DIV,0,DIV,0,PICTURE,2,IMG",
"selector": "div.ms-container > div.newsletter-subscribe--image > picture > img.cmp-image__image",
"boundingRect": {
"top": 2329,
"bottom": 2459,
"left": 0,
"right": 412,
"width": 412,
"height": 130
},
"snippet": "",
"nodeLabel": "div.cmp-pullquote__content > div.cmp-pullquote__image > picture > img.cmp-image__image"
}
},
{
"url": "https://www.morganstanley.com/content/dam/msdotcom/footer-icons/privacyoptions29x14.jpg",
"node": {
"type": "node",
"lhId": "1-2-IMG",
"path": "1,HTML,1,BODY,3,DIV,0,DIV,2,DIV,0,DIV,1,DIV,0,DIV,0,DIV,0,DIV,0,DIV,0,DIV,0,FOOTER,4,SECTION,0,DIV,0,NAV,0,UL,6,LI,0,A,1,IMG",
"selector": "ul.cmp-navigation__group > li.cmp-navigation__item > a.cmp-navigation__item-link > img.cmp_footernav_icon_image",
"boundingRect": {
"top": 5875,
"bottom": 5889,
"left": 304,
"right": 334,
"width": 30,
"height": 14
},
"snippet": "",
"nodeLabel": "Your Privacy Choices"
}
}
]
},
"guidanceLevel": 4
},
"valid-source-maps": {
"id": "valid-source-maps",
"title": "Missing source maps for large first-party JavaScript",
"description": "Source maps translate minified code to the original source code. This helps developers debug in production. In addition, Lighthouse is able to provide further insights. Consider deploying source maps to take advantage of these benefits. [Learn more about source maps](https://developer.chrome.com/docs/devtools/javascript/source-maps/).",
"score": 0,
"scoreDisplayMode": "binary",
"details": {
"type": "table",
"headings": [
{
"key": "scriptUrl",
"valueType": "url",
"subItemsHeading": {
"key": "error"
},
"label": "URL"
},
{
"key": "sourceMapUrl",
"valueType": "url",
"label": "Map URL"
}
],
"items": [
{
"scriptUrl": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/202601.2.0/otBannerSdk.js",
"subItems": {
"type": "subitems",
"items": [
{
"error": "Large JavaScript file is missing a source map"
}
]
}
}
]
}
},
"csp-xss": {
"id": "csp-xss",
"title": "Ensure CSP is effective against XSS attacks",
"description": "A strong Content Security Policy (CSP) significantly reduces the risk of cross-site scripting (XSS) attacks. [Learn how to use a CSP to prevent XSS](https://developer.chrome.com/docs/lighthouse/best-practices/csp-xss/)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"severity": "Medium",
"description": "The page contains a CSP defined in a `` tag. Consider moving the CSP to an HTTP header or defining another strict CSP in an HTTP header."
}
]
}
},
"has-hsts": {
"id": "has-hsts",
"title": "Use a strong HSTS policy",
"description": "Deployment of the HSTS header significantly reduces the risk of downgrading HTTP connections and eavesdropping attacks. A rollout in stages, starting with a low max-age is recommended. [Learn more about using a strong HSTS policy.](https://developer.chrome.com/docs/lighthouse/best-practices/has-hsts)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"directive": "includeSubDomains",
"description": "No `includeSubDomains` directive found",
"severity": "Medium"
},
{
"directive": "preload",
"description": "No `preload` directive found",
"severity": "Medium"
}
]
}
},
"origin-isolation": {
"id": "origin-isolation",
"title": "Ensure proper origin isolation with COOP",
"description": "The Cross-Origin-Opener-Policy (COOP) can be used to isolate the top-level window from other documents such as pop-ups. [Learn more about deploying the COOP header.](https://web.dev/articles/why-coop-coep#coop)",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "directive",
"valueType": "code",
"subItemsHeading": {
"key": "directive"
},
"label": "Directive"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"description": "No COOP header found",
"severity": "High"
}
]
}
},
"clickjacking-mitigation": {
"id": "clickjacking-mitigation",
"title": "Mitigate clickjacking with XFO or CSP",
"description": "The `X-Frame-Options` (XFO) header or the `frame-ancestors` directive in the `Content-Security-Policy` (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. [Learn more about mitigating clickjacking](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation).",
"score": null,
"scoreDisplayMode": "notApplicable",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": []
}
},
"trusted-types-xss": {
"id": "trusted-types-xss",
"title": "Mitigate DOM-based XSS with Trusted Types",
"description": "The `require-trusted-types-for` directive in the `Content-Security-Policy` (CSP) header instructs user agents to control the data passed to DOM XSS sink functions. [Learn more about mitigating DOM-based XSS with Trusted Types](https://developer.chrome.com/docs/lighthouse/best-practices/trusted-types-xss).",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "table",
"headings": [
{
"key": "description",
"valueType": "text",
"subItemsHeading": {
"key": "description"
},
"label": "Description"
},
{
"key": "severity",
"valueType": "text",
"subItemsHeading": {
"key": "severity"
},
"label": "Severity"
}
],
"items": [
{
"severity": "High",
"description": "No `Content-Security-Policy` header with Trusted Types directive found"
}
]
}
},
"script-treemap-data": {
"id": "script-treemap-data",
"title": "Script Treemap Data",
"description": "Used for treemap app",
"score": 1,
"scoreDisplayMode": "informative",
"details": {
"type": "treemap-data",
"nodes": [
{
"name": "https://www.morganstanley.com/stat/onetrust/0194d7d5-a361-7e02-9896-56ea1fa98894/scripttemplates/otSDKStub.js",
"resourceBytes": 26546,
"encodedBytes": 8727,
"unusedBytes": 7312
},
{
"name": "https://www.morganstanley.com/",
"resourceBytes": 1426,
"encodedBytes": 186,
"children": [
{
"name": "(inline) function Optano…",
"resourceBytes": 28,
"unusedBytes": 0
},
{
"name": "(inline) var MSCOM = MSC…",
"resourceBytes": 809,
"unusedBytes": 0
},
{
"name": "(inline)