4 ms·
In summary: * CSP improvements that let you allow/block content much more flexibly, without having to list every possible script host * TrustedTypes, to block
by pimterry 7y ago
In summary:
* CSP improvements that let you allow/block content much more flexibly, without having to list every possible script host
* TrustedTypes, to block front-end XSS and enforce content sanitization
* New request headers for browser requests, which let servers spot & block CSRF attacks
* New response header to block cross-site opener attacks