3 ms·
> Feature-Policy also looks like it could easily balloon to 1KB or more Twitter sends over 6kb of CSP headers on every single request. This is what happens if
by LeonM 7y ago
> Feature-Policy also looks like it could easily balloon to 1KB or more
Twitter sends over 6kb of CSP headers on every single request. This is what happens if you run loads of different advertisement and tracking vendors.
- perlgeek 7y ago> Twitter sends over 6kb of CSP headers on every single request. Now I understand why HTTP/2 uses compression for HTTP headers.
- r1ch 7y agoIf you're implementing CSP, you should only include the header on text/html or other rendered responses, so the overhead is more per-navigation than per-request. I've seen a lot of guides where CSP is added globally at the webserver level which can waste a lot of bandwidth with images etc.