Embed Notice

@hypolite @IceWolf CORS allows you to limit cross domain resources. But I can mine bitcoin on your CPU without any cross domain anything. Hell, in theory,I might be able to send spam that way! I can definitely steal your credit card number.

But if I could just add a X-No-Dynamism header that would say "this HTTP session does not send JS or WASM", I could keep everything on my site safe.

I could let users write pretty unfiltered HTML, and most of the tricks would be contained in a frame.