3 ms·
The CSP info is a little off. Specifically, there are some directives of CSP (in this case frame-ancestors, the replacement for X-Frame-Options) that are specif
by epmatsw 8y ago
The CSP info is a little off. Specifically, there are some directives of CSP (in this case frame-ancestors, the replacement for X-Frame-Options) that are specifically ignored if specified in a only <meta> tag. The header is the only way to have access the full set of CSP features.
- jasonkostempski 8y agoI see that. I couldn't find any justification for that choice either. Any reason I can think of (security, legacy, optimization) would imply the powers that be wouldn't want CSP allowed as a meta tag either. My guess is it's just another bad choice. I've had iframes completely disabled in uBlock Origin for years now and the only time I've found it "breaking" ("fixing" from my perspective) things is when sites do something like third-party run sweepstakes. I think we'd be better off just breaking iframes now for the sake of our children, like we did with Flash et al. Start off with "click to activate iframe" with harsh warnings, then completely remove support shortly after. There are better solutions for sites that are using it for legit reasons.