9 ms·
Is CSP still recommended? I thought it was considered overkill for little benefit
by tootie 5y ago
Is CSP still recommended? I thought it was considered overkill for little benefit
- doliveira 5y agoA lot of it seems specially targeted towards websites with tons of third-party scripts
- bleuarff 5y agoIsn't that the majority of the web today?
- doliveira 5y agoIndeed, but it's messed up that we had to invent all this new standard just to keep including hundreds of Analytics scripts
- tootie 5y agoYeah, I work on some public-facing sites that have analytics and programmatic ads and the like. Our list of script and frame allows would be pretty long. And since the analytics team own and operate out tag manager, they can inject third-party scripts at will without needing a release which makes maintaining CSP a whole job on its own.
- rnicholus 5y agoThere is enormous benefit with a _strict_ CSP. It's unfortunately common for a CSP that whitelists CDNs, allows eval, etc, etc. These are arguably worse than not having a CSP at all due to the false sense of security. More details in this excellent writeup at https://storage.googleapis.com/pub-tools-public-publication-data/pdf/45542.pdf https://storage.googleapis.com/pub-tools-public-publication-....