3 ms·
On top of what others are saying, on modern websites, inline CSS is usually forbidden by the Content-Security-Policy, to provide defense in depth against CSS in
by majewsky 6y ago
On top of what others are saying, on modern websites, inline CSS is usually forbidden by the Content-Security-Policy, to provide defense in depth against CSS injection.
(This SO answer summarizes why CSS injection is something to care about: https://stackoverflow.com/a/718614 https://stackoverflow.com/a/718614)
- httpsterio 6y agoI'm sorry if I misunderstand, but what you linked is related to allowing user created css to be displayed on a service? I don't think it's exactly relevant here. If you're just adding custom css on the page that'd displayed for you, there's no attack vector, but those links in the SO is about injected CSS where the attacker loads custom CSS for other visitors. It's almost trivial to set up a keylogger with css that fires requests on keyboard input. Luckily there's CSP.
- httpsterio 6y agoInline CSS is in no way dangerous though. Its quite commonly used to defer loading the additional css files to stop render blocking the page. By inlining the above-the-fold CSS aka Critical CSS, you can shave considerable amounts of time in time to interactive clears.
- darekkay 6y agoBecause an 11-year-old answer was just deleted by the SO "not an answer" hammer, here are the links from the SO post you mentioned: - http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/ http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-inje... - http://archive.is/20150708191322/http://i8jesus.com/?p=10 http://archive.is/20150708191322/http://i8jesus.com/?p=10 - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...