w3c/webappsec-csp
View on GitHub ↗ ★ 226 HTML
WebAppSec Content Security Policy
8 mentions on Hacker News by 6 people: 2 stories, 6 comments · first 2020-11-12 · latest 2026-01-26
20082026
-
Good time to surface the limitations of a Content Security Policy: https://github.com/w3c/webappsec-csp/issues/92 Also the double iframe technique is important for preventing exfiltration through navigation, but you have to make sure you…
comment by benatkin · 2026-01-26 · in The browser is the sandbox -
…leaving users with nothing. [1] https://web.hypothes.is/help/installing-the-bookmarklet/ [2] https://github.com/w3c/webappsec-csp/issues/444
comment by rektide · 2022-10-02 · in Use Bookmarklets on Chrome on Android (2020) -
The mainstream browsers & spec authors sneer at & detest userscripts, wish they'd never been a thing. https://github.com/w3c/webappsec-csp/issues/444 I agree. This is simple & stupid a problem. It's grossly anti-user. But today, security…
comment by rektide · 2022-07-30 · in I miss the programmable web (2021) -
I found the bug I opened against the csp spec, asking for it to not obstruct userscripts. https://github.com/w3c/webappsec-csp/issues/444
comment by rektide · 2022-07-30 · in I miss the programmable web (2021) -
Probably an issue that should've gotten addressed ahead of standardization, IMHO: https://github.com/w3c/webappsec-csp/issues/92
comment by ocdtrekkie · 2021-01-27 · in WebRTC is now a W3C and IETF standard -
…stupid to me, that's the whole point of connect-src. What I did find was this issue report, https://github.com/w3c/webappsec-csp/issues/7 , stating that connect-src 'self' doesn't allow websockets in many browsers because it's technically…
comment by hn_throwaway_99 · 2020-11-12 · in A new skimmer uses WebSockets and a fake credit card form