2 ms·

> CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). Are you sure ONLY? Enable CSP on a XSS-vulnerable website,

by yeukhon 11y ago

> CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). Are you sure ONLY? Enable CSP on a XSS-vulnerable website, send a payload, CSP prevents XSS from executing if your policy say so.