3 ms·

How?

• dullgiulio 9y ago
  CSP reporting is an unprotected form, in itself a vulnerability. The author of the article is biased as he made a SaaS product for CSP reporting. CSP reporting should be for local debugging only.
  • orf 9y ago
    I'm sorry, I'm still not following. How can CSP reporting be used by marketers? It requires a header sent from the server, so it's not like a tracking pixel that can be added by a third party. And I'm not sure about local debugging only, locally it offers no benefits over just viewing the devtools console, whereas it offers a lot of benefits when enabled on users of your sites.