3 ms·
What's the intrinsic risk in inline javascript? My site uses it to provide page specific data and I'm not really seeing any obvious security risks with it ...
by aquark 13y ago
What's the intrinsic risk in inline javascript? My site uses it to provide page specific data and I'm not really seeing any obvious security risks with it ... then again most security risks aren't obvious!
- cddotdotslash 13y agoThere's not a risk directly, but it conflicts with newer CSP (Content Security Policy) headers. So you can set CSP to only allow external JS (to prevent XSS through a parameter echoed on your page, for example). Then, it will block any inline JS (including the injection). So it's not a security risk, just something that helps prevent XSS through CSP.