4 ms·
In this case, since the attacker has access to the source code, they could easily disable a site's Content Security Policy.
by nateberkopec 10y ago
In this case, since the attacker has access to the source code, they could easily disable a site's Content Security Policy.
- jerf 10y ago"Raises the bar", I did say. They have access but if they're only accessing it through an automated system they may miss it. Plus, I should have pointed out that CSP can be applied at higher layers, including nginx itself or a WAF, that the attacker may not be able to access or modify. I didn't think of it at the time.
- nateberkopec 10y agoGreat point, I didn't think of that either.