2 ms·
Link is not HTML specific. Content-Security-Policy can also be specified as an HTML meta tag, that's where it belongs. CSP obsoletes X-Frame-Options which could
by jasonkostempski 8y ago
Link is not HTML specific. Content-Security-Policy can also be specified as an HTML meta tag, that's where it belongs. CSP obsoletes X-Frame-Options which couldn't be specified as a meta tag only because MS made up that rule when they made up the header, with no justification for it. Everyone followed suit simply because that's what people had to do when MS had a stranglehold on the internet.
I'm sure there are other examples of HTML specific HTTP headers that can't be specified as meta tags because we're still stuck with a lot of crud, but that doesn't mean they're not out of place too. It's just the wrong layer for that data.
- epmatsw 8y agoThe CSP info is a little off. Specifically, there are some directives of CSP (in this case frame-ancestors, the replacement for X-Frame-Options) that are specifically ignored if specified in a only <meta> tag. The header is the only way to have access the full set of CSP features.
- jasonkostempski 8y agoI see that. I couldn't find any justification for that choice either. Any reason I can think of (security, legacy, optimization) would imply the powers that be wouldn't want CSP allowed as a meta tag either. My guess is it's just another bad choice. I've had iframes completely disabled in uBlock Origin for years now and the only time I've found it "breaking" ("fixing" from my perspective) things is when sites do something like third-party run sweepstakes. I think we'd be better off just breaking iframes now for the sake of our children, like we did with Flash et al. Start off with "click to activate iframe" with harsh warnings, then completely remove support shortly after. There are better solutions for sites that are using it for legit reasons.