Blog
Tutorials, guides, and insights to help you become a better developer.
The British Airways skimmer sat in a first-party file, so no host allowlist, no 'self' and no nonce would have stopped it — here is one CSP header tightened four times, broken after each round against the CSP Level 3 matching algorithms, until only the directive nobody writes first is left holding.
AdminAugust 11, 202612 min read