3 ms·

And also extensively used for privacy invasive tracking (1) there is no same-origin restriction for link prefetching and (2) it allow cookies to be planted from

And also extensively used for privacy invasive tracking (1) there is no same-origin restriction for link prefetching and (2) it allow cookies to be planted from tracking servers. ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefe... ).

tiffanyh 4y ago
I thought CSP mitigate this risk. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- webmobdev 4y ago
  As you can see in the linked page, no browser supports it.