3 ms·
If you don't trust Mozilla, how do you trust them not to strip the CSP header whenever they want to serve malicious javascript?
by kijin 9y ago
If you don't trust Mozilla, how do you trust them not to strip the CSP header whenever they want to serve malicious javascript?
- the8472 9y agoyou'd still have to implement a pinning feature. the hash-only-CSP part would just be the foundation which the pin checks.