5 ms·

Couldn't Content Security Policy (CSP) [1] be used to mitigate this attack? [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozill

Couldn't Content Security Policy (CSP) [1] be used to mitigate this attack? [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

maxchehab 9y ago
It actually can't. Instagram does use this protect java-script injection from extensions, but clearly injecting CSS is allowed.
- sbarre 9y ago
  But could you use CSP to block the image loading that happens in the CSS with 'img-src' definitions? Someone else in this thread suggested that as well.
- 15155 9y ago
  The requested resource, however, could be blocked by a CSP.