3 ms·
I still don't understand what it accomplishes. Why does inline matter? The vulnerability means they can inject arbitrary markup including <link> or <script> th
by always_good 10y ago
I still don't understand what it accomplishes. Why does inline matter?
The vulnerability means they can inject arbitrary markup including <link> or <script> that load offsite sources.
You can use CSP to whitelist allowed offsite domains. But if you're not careful, "you never know" and "you might as well" are more likely to waste your time chasing low value things.
For instance, inline CSS is valuable as an intermittent developer convenience, and disabling it takes that away while protecting your from an unlikely event.
Also, you generally should be escaping-by-default and not sanitizing. A templating system should escape by default and make it obvious when you opt out.
- Annatar 10y agoI still don't understand what it accomplishes. Why does inline matter? In the worst case scenario, where the server doesn't have all the blocks of the file cached in random acces memory, the server can fetch the single, inlined file with fewer input operations per second from local storage far faster than one's web browser can fetch multiple files over the network. This means that latency is lowered, and thus delivery time is accelerated.
- always_good 10y agoRight, I meant in regards to this comment chain where "inline CSS is bad if you have an XSS vulnerability."