3 ms·
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Access-Control-Allow-Origin... How many hacks li
by gambler 9y ago
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Access-Control-Allow-Origin...
How many hacks like these will we need before people stop to rethink the fundamental security model underpinning the Web? It's clearly crumbling.
- JetSpiegel 9y agoWe are clearly in the Antivirus level of protection (blacklists) to maintain backwards compatibility, instead of a whitelist of allowed domains or features to use.
- ubernostrum 9y agoCSP is a whitelist-based approach; CSS/JS/etc. will only be permitted from the sources listed in the CSP header.