3 ms·
The most interesting bit is the part about the Link header. Does anyone know if this would be a way of concealing your frontend javascript files?
by dmvaldman 15y ago
The most interesting bit is the part about the Link header. Does anyone know if this would be a way of concealing your frontend javascript files?
- mathias 15y agoThis is not possible; scripts cannot be added through `<link>`, so there’s no way to add them through the `Link` HTTP header.
- dmvaldman 15y agoWould the functionality be possible if browsers wanted to make the functionality possible? I feel like this would be a big deal when it comes to the IP concerns of frontend code.
- willthames 15y agoYour browser would still download the files. You can still the downloads using Live HTTP Headers, Firebug, Fiddler etc. to see what is going on in the background. So it would be like disabling right-click - deter only the least knowledgeable.
- mathias 15y agoIn Opera, it is possible in a way: Link: <javascript:alert(1)>; rel="next" This won’t do anything until you hit the “next” button in the Opera UI (or hit the Space bar, which is a keyboard shortcut for said button). Example: http://xss-shafigullin-pro.appspot.com/reflector http://xss-shafigullin-pro.appspot.com/reflector