4 ms·

Content-Security-Policy: can-set-cookies: no! BTW if JS is of we can use <meta http-equiv Set Cookie>

• jffry 13y ago
  Well OK then.
• twic 13y ago
  It might be better to allow: Content-Security-Policy: can-set-cookies-for-parent-domain: no! There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.