3 ms·
You really should be using Content-Security-Policy to block untrusted scripts. And anything you do not host yourself should be untrusted, no matter how much you
by fmajid 2y ago
You really should be using Content-Security-Policy to block untrusted scripts. And anything you do not host yourself should be untrusted, no matter how much your marketing department whines they want to include Google Tag Manager.
- cxr 2y agoCSP is a poorly designed, dangerous, user-hostile standard that should have never been written, let alone implemented. Better idea than "using Content-Security-Policy to block untrusted scripts": don't link against untrusted scripts.