4 ms·
CSP reporting is an unprotected form, in itself a vulnerability. The author of the article is biased as he made a SaaS product for CSP reporting. CSP reportin
by dullgiulio 9y ago
CSP reporting is an unprotected form, in itself a vulnerability.
The author of the article is biased as he made a SaaS product for CSP reporting.
CSP reporting should be for local debugging only.
- orf 9y agoI'm sorry, I'm still not following. How can CSP reporting be used by marketers? It requires a header sent from the server, so it's not like a tracking pixel that can be added by a third party. And I'm not sure about local debugging only, locally it offers no benefits over just viewing the devtools console, whereas it offers a lot of benefits when enabled on users of your sites.