4 ms·
How would a CSP have helped here? GoDaddy injects that additional script tag right into the HTML file it serves. No policy will help if the web server does not
by raimue 8y ago
How would a CSP have helped here? GoDaddy injects that additional script tag right into the HTML file it serves. No policy will help if the web server does not serve what you uploaded.
- StavrosK 8y agoThe browser wouldn't have loaded the linked JS file. This is exactly the attack that CSP is designed to thwart. Then again, GoDaddy could just rewrite your headers.
- deleted 8y ago[deleted]
- kodablah 8y agoThat's not true. CSP can have a specific host/path for scripts and won't even run JS in the page without explicitly opting in to 'unsafe-inline'. It's an important prevention technique against XSS for pages showing user generated content.
- raimue 8y agoMy point is that if GoDaddy modifies the HTTP body, they could as well modify the CSP you send in the HTTP header. It is yet another stop-gap, but the real solution is to get a hoster you can trust.