4 ms·
Very interesting. I didn't know about `crossorigin=anonymous` and `referrerpolicy`. You wouldn't believe how many "privacy-focused", "E2E encrypted", etc. web a
by analyte123 6y ago
Very interesting. I didn't know about `crossorigin=anonymous` and `referrerpolicy`. You wouldn't believe how many "privacy-focused", "E2E encrypted", etc. web apps are just blindly loading things from multiple CDNs with no SRI and no CSP (let alone anonymous CORS or no-referrer).
Speaking of CSP, should it be in this list? It allows you to whitelist scripts that run on your page, prevent 3rd-party scripts from loading media, and act as a kind of application firewall with `connect-src`.
- AdriaanvRossum 6y agoI totally agree on your point about CSP. Will add it to the post, thanks for sharing your feedback! Edit: I just added a section about CSP [1] [1] https://blog.simpleanalytics.com/practical-privacy-tips-for-your-business#content-security-policy https://blog.simpleanalytics.com/practical-privacy-tips-for-...