2 ms·
It sucks that even a good Content Security Policy [0] can't stop an iframe from making these types of requests. [0]: https://developer.mozilla.org/en-US/docs/W
by ezekg 4y ago
It sucks that even a good Content Security Policy [0] can't stop an iframe from making these types of requests.
[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- jefftk 4y agoYes: it would be great if a site could use something like CSP to ensure that if they've only gotten consent for vendors A and B that vendor B doesn't go violate their contract by bringing in unconsented vendor C. (Though in this case B and C are both Google, and in a slightly different world both Google Pay and Google Analytics could be hosted on the same domain.)