Blog

The British Airways skimmer sat in a first-party file, so no host allowlist, no 'self' and no nonce would have stopped it — here is one CSP header tightened four times, broken after each round against the CSP Level 3 matching algorithms, until only the directive nobody writes first is left holding.

Express has the ecosystem, Fastify has the schema validation, and Hono runs everywhere. Here's the practical breakdown of all three so you can actually make the call.