12 ms·
That's not true. CSP can have a specific host/path for scripts and won't even run JS in the page without explicitly opting in to 'unsafe-inline'. It's an import
by kodablah 8y ago
That's not true. CSP can have a specific host/path for scripts and won't even run JS in the page without explicitly opting in to 'unsafe-inline'. It's an important prevention technique against XSS for pages showing user generated content.
- raimue 8y agoMy point is that if GoDaddy modifies the HTTP body, they could as well modify the CSP you send in the HTTP header. It is yet another stop-gap, but the real solution is to get a hoster you can trust.