Skip to content

Comment on Hardening the Firefox Front End with Content Security Policiesparent

Comments

It's called Content Security Policy, not Content Performance Policy

As is often the case with security, the downsides of locking something down may not be worth the increased security .

Another reason not to prohibit inline scripts and stylesheets is if you need to dynamically generate them (although I think strict-dynamic would allow that).

External resources can be cached across multiple pageloads.

That only matters if the resource is actually shared across multiple pages

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.