3 ms·

A lot of it seems specially targeted towards websites with tons of third-party scripts

• bleuarff 5y ago
  Isn't that the majority of the web today?
  • doliveira 5y ago
    Indeed, but it's messed up that we had to invent all this new standard just to keep including hundreds of Analytics scripts
• tootie 5y ago
  Yeah, I work on some public-facing sites that have analytics and programmatic ads and the like. Our list of script and frame allows would be pretty long. And since the analytics team own and operate out tag manager, they can inject third-party scripts at will without needing a release which makes maintaining CSP a whole job on its own.