5 ms·
As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?
by scraplab 4y ago
As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?
- xfitm3 4y agoStrides have been made in web security, check out the permissions policy[0] along with COOP and COEP[1]. [0] https://www.w3.org/TR/permissions-policy-1/ https://www.w3.org/TR/permissions-policy-1/ [1] https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-report-uri/ https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-r...
- robocat 4y agoMDN docs for Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (for anyone unfamiliar with that browser feature that should in theory disallow injection for websites you control).
- the_mitsuhiko 4y agoExternal sources yes, preventing an app to inject inline HTML and JavaScript is tricky.
- ezekg 4y agoYou can block all inline scripts via CSP.
- the_mitsuhiko 4y agoThat’s why I said tricky and not impossible.
- RKearney 4y agoNot only would CSP block it, but this type of behavior only strengthens Apple's decision to not allow third party rendering engines. Could you imagine the privacy nightmare that would ensue if Facebook could release a browser that bypassed any and all safeguards implemented by site operators?
- piaste 4y agoIf it were only Apple's restrictions preventing this, why wouldn't Facebook release such a browser on Android?