3 ms·
The linked W3C mailing list[1] provides some interesting discussion, as well as a blog post from Jan outlining this attack[2]. The conclusion: security benefit
by retroencabulato 12y ago
The linked W3C mailing list[1] provides some interesting discussion, as well as a blog post from Jan outlining this attack[2].
The conclusion: security benefits of CSP outweigh cons.
[1] http://lists.w3.org/Archives/Public/public-webappsec/2014Feb/0036.html http://lists.w3.org/Archives/Public/public-webappsec/2014Feb...
[2] http://homakov.blogspot.de/2014/01/using-content-security-policy-for-evil.html http://homakov.blogspot.de/2014/01/using-content-security-po...
- gpvos 12y agoThanks. Especially the homakov post is enlightening, as it explains that removing the report-uri feature is not even enough to make this exploit impossible, as the onload/onerror events also signal success or failure. Is there anything good that report-uri is used for that is more important than removing this exploit possibility?
- pfraze 12y agoReport URIs are pretty important for deploying CSP on an existing site. Without it, you'd have to risk breaking the experience for a lot of users (because it's hard to nail the policy on the first try) and you'd never get any logs explaining what was blocked.