45 ms·

is the default-src necessary if you're using sandbox or is it redundant?

• johncolanduoni 2y ago
  `sandbox` doesn’t affect making requests via HTML (images, stylesheets, etc.).
  • deleted 2y ago
    [deleted]
  • nightpool 2y ago
    Right, but what would be the security impact of that compared to just plain HTML? I guess it allows for some form of view counting or IP exfiltration, but other than that anything you can do with an external request you could do with an embedded data URI.
    • brewmarche 2y ago
      As far as I understand CSP, since it’s set to `none`, no URIs are allowed, not even `data`. Inline scripts and stylesheets are not allowed either, since `unsafe-inline` (or nonces/hashes) is missing.