3 ms·
CSP allows blocking inline scripts right? But 1. should exist regardless to complement the existing caching options. It shouldn't be sent by default to avoid a
by MichaelGG 11y ago
CSP allows blocking inline scripts right?
But 1. should exist regardless to complement the existing caching options. It shouldn't be sent by default to avoid adding another tracking method, but if the source page specifies a hash, and you have that hash, then If-Hash-Mismatch is perfect.
2. Bingo, winner.