6 ms·
> An even bigger WTF, though, is that the server gets to control through CSP which off-site style sheets the user can link against and even whether use of the s
by madeofpalk 3y ago
> An even bigger WTF, though, is that the server gets to control through CSP which off-site style sheets the user can link against and even whether use of the style attribute is permitted.
I don't understand the problem. This is exactly the use case for CSP - allow the server to lock down to a more restricted, and safer subset of the web platform. It plays an important part in providing a failsafe for displaying untrusted/user content on the web (and elsewhere).
I know of one podcast client that uses CSP to safely render HTML podcast notes, blocking the loading of images and any external assets. Pretty neat if you ask me.
Why do you think CSP is user hostile?
- hahn-kev 3y agoThere's a difference between user content, which could include injection attacks. And what might be called operator content (operator of the browser in this case, which could also be considered a user), sure I want to be protected against hostile injection, but I should be able to inject code into my own browser without any issue.
- crtasm 3y agoWould a userscript running in Greasemonkey/Violentmonkey help in this case? I inject code into every site I visit.