3 ms·
An all-new reason to use Content-Security-Policy. How much you want to bet that thing is XSSable?
by kentonv 12y ago
An all-new reason to use Content-Security-Policy.
How much you want to bet that thing is XSSable?
- pmh 12y ago>An all-new reason to use Content-Security-Policy Correct me if I'm wrong, but I don't think any amount of CSP will help you in this situation. They're MITMing traffic and thus can modify the CSP headers.
- kentonv 12y agoFair enough, though I'd bet they aren't smart enough to have actually blocked the header. They apparently don't even support WebSocket.