Conversation

Notices

1. Embed this notice
   Foone🏳️‍⚧️ (foone@digipres.club)'s status on Sunday, 03-Nov-2024 11:17:31 JST Foone🏳️‍⚧️

   hey, web administrators: be careful with your content-security-policy headers. yeah it's nice to set up a good cross-site-scripting policy, but you shouldn't be leaking information to attackers with it.

   • alcinnz repeated this.
   • Embed this notice
     Foone🏳️‍⚧️ (foone@digipres.club)'s status on Sunday, 03-Nov-2024 11:17:31 JST Foone🏳️‍⚧️

     in reply to

     I just checked the logs for a simple HTTP request to their top level site and it defined a content security policy for 92 separate domains.
     Including a lot of fun ones with names like "sandbox.company.egg" and "debugging.company.egg" and "embedded.demo.company.egg" and "debug-preview.company.egg"

     all of which is pretty questionable when you already defined a *.company.egg policy!