5 ms·
You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP
by ATsch 8y ago
You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.
- austincheney 8y agoCSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute. This approach has the added benefit of letting you know that malicious things are happening.
- lozenge 8y agoCSP has report options.