4 ms·
Can this be circumvented by a very strict Content-Security-Policy?
by roebk 4y ago
Can this be circumvented by a very strict Content-Security-Policy?
- paxys 4y agoIt’s on the browser to enforce CSP headers. In this case the browser itself is doing the malicious script injection. Think of it as a browser extension, just running without your consent. It’s up to the browser - not the website - to reject it.