4 ms·
This makes sense, but it feels like the case is overstated... Is it really common for sites to disable their own onclick attributes? Is it just the case that th
by crabmusket 2y ago
This makes sense, but it feels like the case is overstated... Is it really common for sites to disable their own onclick attributes? Is it just the case that the CSP rule disables onclick in the HTML, but first party scripts can then attach event handlers separately?
- jameshart 2y agoIf you’re dynamically generating the HTML it’s safest to set the CSP to disable all inline scripts; you can permit only static scripts served from known good locations with valid sub resource integrity hashes.