Possible solutions: 1. Add an If-Hash-Mismatch header so you don't need to transfer the body 2. Add a list of hashes to accept to the content security policy

Possible solutions: 1. Add an If-Hash-Mismatch header so you don't need to transfer the body 2. Add a list of hashes to accept to the content security policy headers 3. Add a list of public keys to accept to the content security policy, and allow the content if it's signed by one of those (this requires some standard way of signing things, maybe PGP/MIME or a dedicated HTTP header) 4. Only allow this from <script> and <style> tags that are in the <head>, or that are at "end" of <body> (meaning there are no tags other than <script> or <style> afterwards), or resources referenced from CSS and JavaScript files loaded that way. EDIT: 5. Add an ECC public key (Curve25519?) to the content security policy, and accept hashes where an extra attribute is specified providing an inline signature of the hash with the key The idea of the last one is that XSS would usually happen in in the middle of the body and not in the head or footer. That said, you can XSS with inline script, so it seems this only mitigates XSS vulnerability with length limitations on the payload (EDIT: nope, CSP blocks inline script).